the app needs certificates to listen for TLS, and errors out and doesn't start if they're not present