locals { cert_options = <