diff --git a/data/bc01n01.hswaw.net-kube-node.crt b/data/bc01n01.hswaw.net-kube-node.crt
index 2402e56..faaac92 100644
--- a/data/bc01n01.hswaw.net-kube-node.crt
+++ b/data/bc01n01.hswaw.net-kube-node.crt
@@ -1,34 +1,34 @@
 -----BEGIN CERTIFICATE-----
-MIIF0zCCA7sCCQCA8T/OXbv3DTANBgkqhkiG9w0BAQsFADCBtzELMAkGA1UEBhMC
-UEwxFDASBgNVBAgMC01hem93aWVja2llMREwDwYDVQQHDAhXYXJzemF3YTEuMCwG
-A1UECgwlU3Rvd2FyenlzemVuaWUgV2Fyc3phd3NraSBIYWNrZXJzcGFjZTEQMA4G
-A1UECwwHaHNjbG91ZDEaMBgGA1UEAwwRQm9vdHN0cmFwIE5vZGUgQ0ExITAfBgkq
-hkiG9w0BCQEWEnEza0BoYWNrZXJzcGFjZS5wbDAeFw0xOTAxMTIyMDAyNDRaFw0x
-OTAyMTEyMDAyNDRaMIGeMQswCQYDVQQGEwJQTDEUMBIGA1UECAwLTWF6b3dpZWNr
-aWUxFDASBgNVBAcMC01hem93aWVja2llMRUwEwYDVQQKDAxzeXN0ZW06bm9kZXMx
-JDAiBgNVBAsMG0t1YmVybmV0ZXMgTm9kZSBDZXJ0aWZpY2F0ZTEmMCQGA1UEAwwd
-c3lzdGVtOm5vZGU6YmMwMW4wMS5oc3dhdy5uZXQwggIiMA0GCSqGSIb3DQEBAQUA
-A4ICDwAwggIKAoICAQDOaZ50brBSgDovLotGHIB1ZhV9fn+vUrIdlVGA3Wl5Noxn
-nR8dsPs6on7I6rWgUJS2xvKMBLRRLVhO9cVe2mhZSWqXMwWGvcebzW+36b/mCwnq
-ldv16ZyiuljTjwDXd0949+CSXfAGYLjZ4GLTD7u/75THJAJxxSAkmcwnVgnfL3is
-oTPmHy6PPlohc9nJd6QOjQF9MER5BwRHtJnQkswFGpBInBK31/5M9/cdjOxrVKVX
-tijor3+zdFmldZC0BRq03lvY4MXvZJw94PhY4Rf6mH76YqfCH61MQXpf6mTYuOU+
-tnrNtyymFXHmVww0t8IlKRKivjs64Plo96ycb90MxyAZKDCmxr9RPgjXYUHRNOG0
-uGL1n9emSJqGbGR4BzpxXZ9Wg/X7OThAAywTKEGujjFiBSw791I0Ilad4qRZVX6t
-tUVm4oy9MmE4VzY1Y3Qi7oF70p7W67U2vE2aclDOZMuOl3sS5GVgLrXi+KoDLx8y
-JJ9j+gY8Q1/nLzgd2tdz67UQ0j9MPA/KW3xLFnOeanz+xgjRrSWqm4G+vSQ5/Wsf
-dqBOBBa00Y38E6Nz+mS7PRWYqI8mz3B7p42riAnTNPu8qNn5RX7k5GvlNVg/RS8J
-YgNOUg9qMntNhfpeIC9cJRbm1M3Z45r2ojMyLwJvas4vGBWLm/SrU6O81O07SwID
-AQABMA0GCSqGSIb3DQEBCwUAA4ICAQCNXBrB69b6N2VKOpxcm7Ei0Q6YMzbHg6do
-SWf5VTHCYKYq235ZA1hIIuK5DldwwPr0pWiFSdzzMItKFACAkJt3TxB4wkt+QsR/
-pPwJk8UBjIUwyEw1k1VTjlRC7kKdjaDUmWFNs5pHunP3XkYhQS0vqTKnSchTH2wa
-RYGokFjgzNeEH+mm14pWDFz52etoQNx/R1i9wQDlCNaf8I+k28wOq3CtJrX0Cu4r
-YIwUzbQYXF4ganN5UWwF63KcZhtxq3sWvEIO1CnXJgtEZO55deomALZ5UbRqxuX0
-NvlhszoDU5S15/NyX8yEtlGDybxPFxxztHLThv9wfNVzoGj/HcdGK03bchK38OzF
-1tr7mo2U1FaKMwySioYuIPqx+o5KC2lhIYCkV3txAHdjsw6IGvSf8Fzc+OLnBhym
-4CydO9ntKsIDZtkLOIfrUOjV3JpVMpQtTKaZaxk8c1Ivh9oHv8sRqhdGWQIXVCnI
-d7R9Z6Tw7N/ErRbe9h3vVTj4gGidaglwMoAbc5S14AHN2VD42aCm9LsQ8AKmYqPD
-dtXtTD4M6oV98GPg1Wb743ineWrSXoFmJtsIjQHaLrIU6w2je4j8I3C1zXXJi8PW
-F2Qzt4v00D8DHqsBMzLNJMIdr/XIU7WjUdEC+Os3t2v/FySLM0lXlcRe2lop7ikh
-oL5JNFvztA==
+MIIF+jCCA+KgAwIBAgIJAIDxP85du/ccMA0GCSqGSIb3DQEBCwUAMIG3MQswCQYD
+VQQGEwJQTDEUMBIGA1UECAwLTWF6b3dpZWNraWUxETAPBgNVBAcMCFdhcnN6YXdh
+MS4wLAYDVQQKDCVTdG93YXJ6eXN6ZW5pZSBXYXJzemF3c2tpIEhhY2tlcnNwYWNl
+MRAwDgYDVQQLDAdoc2Nsb3VkMRowGAYDVQQDDBFCb290c3RyYXAgTm9kZSBDQTEh
+MB8GCSqGSIb3DQEJARYScTNrQGhhY2tlcnNwYWNlLnBsMB4XDTE5MDExMzAzMzA1
+OFoXDTE5MDIxMjAzMzA1OFowgZ4xCzAJBgNVBAYTAlBMMRQwEgYDVQQIDAtNYXpv
+d2llY2tpZTEUMBIGA1UEBwwLTWF6b3dpZWNraWUxFTATBgNVBAoMDHN5c3RlbTpu
+b2RlczEkMCIGA1UECwwbS3ViZXJuZXRlcyBOb2RlIENlcnRpZmljYXRlMSYwJAYD
+VQQDDB1zeXN0ZW06bm9kZTpiYzAxbjAxLmhzd2F3Lm5ldDCCAiIwDQYJKoZIhvcN
+AQEBBQADggIPADCCAgoCggIBAMmgCuw8NEbYDPAYxT+3RXKnr8tpKFam0UTIPEO5
+PZ63gEJHm5pdhlDbojKfNzWiSliUQ3qtxeFZfA5NLkdhwJesBPXOUcZkzNGIBces
+nmetfN2sakbUwTucCTjVDq5gAXQ5wlHGjMI7G9iddjF1DmvE+s2ewtCOa6nR1v7b
+Ltx7gmuxorq5FtWTnzeTLz+35savmz+5gQ4hTgEDVyne/BCJ+DeVynawgJ8LGGbg
+zpiyoQE3Fl0Aqy96J1uUOhpJ1r4XVv4H1vzmJclRJjx/m6QsJy9VPKUX382dQVgD
+98eVokg+BusblxW4+mY/WNv5a7N2L7h4ek4s2ocyVjUKBo67vipd0EbES0mHSOJe
+zwYU8lQ5QIRsnJkUocGcwGDZ4eLijdYDz++SqBsqwbziprpSw+m3Wyl0F6BCYLvH
+5l9tsMC569jEhQUZ64+NoN4dls6URO4IdtX4ZSONeydaxIfd51CVPyIviT0jlCto
+Ii3AkSbsNBZDR16T7e6b6zPaPEBnk1g1SbcVbGi1gIPyrU788m+QbDUo/E8m2WzQ
+ou9DlMgMEXJg3QMHJwqUiazNxL3OTSiw0p5d6cXzRA1+21l8TdGfzgnefSDapbBG
+RN5WjzW6Vx2lrEcG2Novf3Hlk4/rrHTc8/Sh4pdnGO2R3JWqG/UqbMForp8emuMk
+l6MBAgMBAAGjIDAeMBwGA1UdEQQVMBOCEWJjMDFuMDEuaHN3YXcubmV0MA0GCSqG
+SIb3DQEBCwUAA4ICAQA/ASwzUfjy0rQKbt2a3aheYLwF6ZUpuI6GSTElXiNfPSyh
+XpN6hWkrAetk2ReCxMHuvbNA2Bt6poKUURKOtfJGf1//a2qWeJTMwx3ALSJOrzfF
+18RIJK8zOkgr3LjjbqFQbeT/yAxyhTx5nOfbQA/dOfo2vOBb+4lrhGFheO4VvOQq
+1bcWWTE7rdQBhcIh3dYawKAE4UHHUPCOAPjbLyrAnvZCQXZXgAitExhue+l13rFZ
+ko0T8Il6rAf7eUWjJPfnBJHKGh2YXL2O3YgcJnPQs9EzmJKCjsaTEjA70sB/A4yY
+lc6ZeATT0iwnKcJYkRsu4gX8VwG9yYDk3vNUGorStdiqKFCGwHuTqmj0ArITNMLe
+Mo8FBeB3YzCd354roHATfWwRGMmu1xzZmOC/Yi8XGQwDYBmkKguEAayuqJnYiAVd
+H3tf5Xytj0LVWcWy2kb5Xl131JQe1cMb4Do9fvYM5H2e39bZorq7z6QjKK8IKdWU
+Q48ExHJ0HBclu34DE1orljxkD3seE7xziWgO2WfEYShaQgrl9U0VJBWQqnGvFj3c
+lCx8ZbDGZAhhvfYM5E+R16LPDZ3L9vt0ea/Lmhzg23GFQmfsD6fsw3CJPHOir5UC
+tSzRY23cl2Fc1FDnH9CXgBwEFIAjm4oJSkbEcXUvkDwqlWghvFue+uv/TvtkUg==
 -----END CERTIFICATE-----
diff --git a/data/bc01n01.hswaw.net-node.crt b/data/bc01n01.hswaw.net-node.crt
new file mode 100644
index 0000000..46e5781
--- /dev/null
+++ b/data/bc01n01.hswaw.net-node.crt
@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF3zCCA8cCCQCA8T/OXbv3GDANBgkqhkiG9w0BAQsFADCBtzELMAkGA1UEBhMC
+UEwxFDASBgNVBAgMC01hem93aWVja2llMREwDwYDVQQHDAhXYXJzemF3YTEuMCwG
+A1UECgwlU3Rvd2FyenlzemVuaWUgV2Fyc3phd3NraSBIYWNrZXJzcGFjZTEQMA4G
+A1UECwwHaHNjbG91ZDEaMBgGA1UEAwwRQm9vdHN0cmFwIE5vZGUgQ0ExITAfBgkq
+hkiG9w0BCQEWEnEza0BoYWNrZXJzcGFjZS5wbDAeFw0xOTAxMTMwMzIxNDNaFw0x
+OTAyMTIwMzIxNDNaMIGqMQswCQYDVQQGEwJQTDEUMBIGA1UECAwLTWF6b3dpZWNr
+aWUxFDASBgNVBAcMC01hem93aWVja2llMS4wLAYDVQQKDCVTdG93YXJ6eXN6ZW5p
+ZSBXYXJzemF3c2tpIEhhY2tlcnNwYWNlMSMwIQYDVQQLDBpOb2RlIEJvb3RzdHJh
+cCBDZXJ0aWZpY2F0ZTEaMBgGA1UEAwwRYmMwMW4wMS5oc3dhdy5uZXQwggIiMA0G
+CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCu96QoKSTxlA1mlckkXR5DhANlACOG
+aE/z/6Wxi/2pGYV0jBeml6OCKscuA4dVOuCnpgb3NDtN1q5pYyRw6v7vm2SVjwZI
+3i6jF2KHYT/2AShohjvQCiCCxVlejBYIZGt1cFL1r7pTm9DAGCcV2rVJOtbtrUpt
+10UMGHRw3IRZWjbYdjxuq08AzyRVXiEUGD72OogXW2FGoltY8VXeItlPdib43UTy
+81UrYLzVuV3WzfuUSuE8bFi8FA8SHDtcVqwq3xbwH1KCk9C9Z0XroErhjq00Iu6O
+Jp6sVBUH7FL81w9feffZtX79i8MbyDFRvItEePBInaxxq5oi7BbRsuvZmSbK7Cou
+hOKhFeyyxj6HJChvp23DSsR7uhX3XLLlIokCA23bYo2MK+gHkxTfLdAbNfdeF12n
+8tM7ZFMQ6WY35mVl9wSixpTNxqUtfFhJ88GUYiN5vgVPf/fr2mtJ8X5LQpweTfAL
+RCRUFHU16sOJsWqBgztR8JXixfRrVoPQ1+0HftagyMmbjTe++b4wHhgBEeHn/m7e
+vm6YqUTDgCFXCoMxiQ0hyvieqoqZbGaD7jjPGCbQwtyiEmqmkc+9wIMa+aFJFOTH
+uylIN9mmbAgD10QWRnGXl0ebY3deRc1a168tLGxq92Qwev4FLb+efP04HM3au5Ar
+WvrBXI1+0t9HCwIDAQABMA0GCSqGSIb3DQEBCwUAA4ICAQBRHblAlrD0nJQf3pHO
+H/HmEf2Io6CWx83+hvtsLy7W0VT639JA2DvsIe3qfk4XSMpfLJwszRWbEcxqsqH8
+Tb5599KLFQ4LuFkfYb2qh6Aqg9Rra4tOLkHGb/RZz2kYzJfNr5fNFMhloXDI4qKw
+Ztc5ZO/jq5CUh4taspx/Z1oeHCP4/3Olg+mPtcTMmj835CcoffbKaTKHTuNWIT95
+dWwOMeZ3gMaggDolfSBdZWxUUXJZkwxIcM0VHasgb6OdBldpS3JsbSUV5oIYoD6I
+HBNN30Uqj+L4XhblhN6wEdCBgkkx5jMgBl3bfAyTz22Od9dKFU9omDb/Hg7+Cbqg
+b53LgR+jACecVz9DNfTu4eHRuKKF7jFMi0DVLLUd7EcsGRj8zXPd+hrTTRjPcZZ3
+I5KokoZDhpctU/eapE7tTHjrKgdtvp6EDgfzaC0rbt1ut7vokGWNWhQ0IFCBIQZv
+xtTqyhVpV2cS3H47fm/vPXJhoiLs2DfxVa2n2LSx75aC24HXDCVCDtT+Rf6+QH3h
+7sZ7OI80aAlXUa3TiZocOGCvOKr4GAVJ68Kpim8Rn4qgIA4wPqUXcdtVjy633BoK
+txAaM4LN3SSb1RwmgZx3hm5mLvJ194LSEUPsVe60N65jcSkKAbKOkSyScRODu7Pb
+gy6l4a49WUmiJlse+3SRGodNww==
+-----END CERTIFICATE-----
diff --git a/data/bc01n02.hswaw.net-kube-node.crt b/data/bc01n02.hswaw.net-kube-node.crt
index 702c54f..e92410d 100644
--- a/data/bc01n02.hswaw.net-kube-node.crt
+++ b/data/bc01n02.hswaw.net-kube-node.crt
@@ -1,34 +1,34 @@
 -----BEGIN CERTIFICATE-----
-MIIF0zCCA7sCCQCA8T/OXbv3ETANBgkqhkiG9w0BAQsFADCBtzELMAkGA1UEBhMC
-UEwxFDASBgNVBAgMC01hem93aWVja2llMREwDwYDVQQHDAhXYXJzemF3YTEuMCwG
-A1UECgwlU3Rvd2FyenlzemVuaWUgV2Fyc3phd3NraSBIYWNrZXJzcGFjZTEQMA4G
-A1UECwwHaHNjbG91ZDEaMBgGA1UEAwwRQm9vdHN0cmFwIE5vZGUgQ0ExITAfBgkq
-hkiG9w0BCQEWEnEza0BoYWNrZXJzcGFjZS5wbDAeFw0xOTAxMTIyMTM0NDlaFw0x
-OTAyMTEyMTM0NDlaMIGeMQswCQYDVQQGEwJQTDEUMBIGA1UECAwLTWF6b3dpZWNr
-aWUxFDASBgNVBAcMC01hem93aWVja2llMRUwEwYDVQQKDAxzeXN0ZW06bm9kZXMx
-JDAiBgNVBAsMG0t1YmVybmV0ZXMgTm9kZSBDZXJ0aWZpY2F0ZTEmMCQGA1UEAwwd
-c3lzdGVtOm5vZGU6YmMwMW4wMi5oc3dhdy5uZXQwggIiMA0GCSqGSIb3DQEBAQUA
-A4ICDwAwggIKAoICAQDhkjw8Gslq6I6Pj8Eip8+4DH1+9h7d5ioejEKb4q20eANo
-cBOl2iS3px9d77Z77DRNqLQi0J/6OfXtLEJh5VRal5LOfppkmKUmnCyz45MDjfn4
-xXlZmvDQz02ah1Z2yAGruJl8+SgBK2sOoL3MY0Bupg30GY72QVrTWYiz46102VUy
-mIk+uFaehkZv6V1pg2gB1U1n6e2rame7gIC/GNieBS3uMycQ/KHamj9UCqLgEaS3
-YT2724Oksy3AQZUiyrLfLgfrYykpKK+rmaZc/WcnAakFMFw9mLupT8Da+Hnmh3Nt
-q6rGDYepG0SANh1YqIcv9R4Msl80dc7FSIgIjmi6XEzKka5QwC4+wj4ktfohgxJC
-FGhyRraZnqpb1r0IJAZXJZ59+CPlyaCoH4eTfArnmsFqEWJYefaV+Vyv2+XkUD3p
-t/L8XQwJIbiPxa8QTTUgLJWUy9v78ZdeTTFAwnx1Cc8Ku7q6UHtyiVo4EZUv58oY
-qRx9Zxn4PyDjW5rE1Y2m1XLnk8CMWxmcYnIXOeZDa62UWYi50GsKip2QlQiGqARo
-edu0PyZkZOYnrWjDmAIfoycT03UgCSKv2Yxfxl+Zp/krHfDzoFx5Ia1S/tl1e3QQ
-0u5Ptpyo+fc9cfLX6Ok+le1XbKKfwJi5b94BDTwfdwptt8Q1euIY4OZRoHZLdwID
-AQABMA0GCSqGSIb3DQEBCwUAA4ICAQCg+RoIq4o4LfyYmkPK6cTTiBdObc/eudUj
-oveyjJfQfUm4jhy7KnEdVodQ4Tg3wizR6qTRfepJsxisFIRxP5oHvuGfNcBLOoOr
-Sp3gqHdwsOBA+DwIkdkVE6lEPqhv7k4Tlp7dAxNSAIJl3HgIsUi0OBRwue/pSpZN
-euxyKR+VI0iydzis9e+z1AlHfhLMnybc94Ds86DbXnSZH8a3LLuW8WLqLUAatml/
-xQDG9mnOaQ/qoDP80LCTUkR4WzTTlnyzoAfv8aaABunW8mqJYKZuPbUtB5BHomic
-HHd0Tay2clgSX457pNWvxPbgEKJtlWm8Opss0Hf7SHISFnu50aHu4w1LGSiwIA9t
-gl1HoeG6bPePwFs3zuhCS9Eej8LRIlUUypeFjG+c+7uhca5ErUHYrWQ4ke3HW1VW
-COEe/1hpup9uQoXWq2Ze6k2FXJH1lCSfvztQuVwydaErkKNhMUYBipthPEMAUggE
-/M8gcfU0pK8IFGdSoYqqkHmsHPAqwADugQhZHX0GNVgWmTR5ZMaXMKdtEVojJlmJ
-5l1dxvOsaCeOisKPirwEoAvdPX3a5kDJOYrTe9jYoFBZpBLsFc+qBfe81TSTjczL
-ECjBZFYFrveMQdOGLqSztqiQAgM1NibtuPHkWKkr6D+J4Vf/Yen5EuGhTsmtViwp
-9wUKl0+Brw==
+MIIF+jCCA+KgAwIBAgIJAIDxP85du/cdMA0GCSqGSIb3DQEBCwUAMIG3MQswCQYD
+VQQGEwJQTDEUMBIGA1UECAwLTWF6b3dpZWNraWUxETAPBgNVBAcMCFdhcnN6YXdh
+MS4wLAYDVQQKDCVTdG93YXJ6eXN6ZW5pZSBXYXJzemF3c2tpIEhhY2tlcnNwYWNl
+MRAwDgYDVQQLDAdoc2Nsb3VkMRowGAYDVQQDDBFCb290c3RyYXAgTm9kZSBDQTEh
+MB8GCSqGSIb3DQEJARYScTNrQGhhY2tlcnNwYWNlLnBsMB4XDTE5MDExMzAzMzIw
+M1oXDTE5MDIxMjAzMzIwM1owgZ4xCzAJBgNVBAYTAlBMMRQwEgYDVQQIDAtNYXpv
+d2llY2tpZTEUMBIGA1UEBwwLTWF6b3dpZWNraWUxFTATBgNVBAoMDHN5c3RlbTpu
+b2RlczEkMCIGA1UECwwbS3ViZXJuZXRlcyBOb2RlIENlcnRpZmljYXRlMSYwJAYD
+VQQDDB1zeXN0ZW06bm9kZTpiYzAxbjAyLmhzd2F3Lm5ldDCCAiIwDQYJKoZIhvcN
+AQEBBQADggIPADCCAgoCggIBAOGSPDwayWrojo+PwSKnz7gMfX72Ht3mKh6MQpvi
+rbR4A2hwE6XaJLenH13vtnvsNE2otCLQn/o59e0sQmHlVFqXks5+mmSYpSacLLPj
+kwON+fjFeVma8NDPTZqHVnbIAau4mXz5KAEraw6gvcxjQG6mDfQZjvZBWtNZiLPj
+rXTZVTKYiT64Vp6GRm/pXWmDaAHVTWfp7atqZ7uAgL8Y2J4FLe4zJxD8odqaP1QK
+ouARpLdhPbvbg6SzLcBBlSLKst8uB+tjKSkor6uZplz9ZycBqQUwXD2Yu6lPwNr4
+eeaHc22rqsYNh6kbRIA2HViohy/1HgyyXzR1zsVIiAiOaLpcTMqRrlDALj7CPiS1
++iGDEkIUaHJGtpmeqlvWvQgkBlclnn34I+XJoKgfh5N8CueawWoRYlh59pX5XK/b
+5eRQPem38vxdDAkhuI/FrxBNNSAslZTL2/vxl15NMUDCfHUJzwq7urpQe3KJWjgR
+lS/nyhipHH1nGfg/IONbmsTVjabVcueTwIxbGZxichc55kNrrZRZiLnQawqKnZCV
+CIaoBGh527Q/JmRk5ietaMOYAh+jJxPTdSAJIq/ZjF/GX5mn+Ssd8POgXHkhrVL+
+2XV7dBDS7k+2nKj59z1x8tfo6T6V7Vdsop/AmLlv3gENPB93Cm23xDV64hjg5lGg
+dkt3AgMBAAGjIDAeMBwGA1UdEQQVMBOCEWJjMDFuMDIuaHN3YXcubmV0MA0GCSqG
+SIb3DQEBCwUAA4ICAQCfzQoxBJDC4H7ibYcE/b5tV01XNYQHWctd/9Kmu5nCP3EV
+J10+neSxClp9OsDFlow32GL5TKZVrmEAiGw0Oy2HTawG0Nd781T9L0py2Gd7R7tE
+40qBIHh8Xdpn5mGWtevXMWbN2phrV2sS2qn7lO1HhLbjgAJefXApiiQZbWv1oh/1
+flwIi+fZxWZ01GRnJEtkU5bGoHqLhDRh+9bGS2Fi4NqrZkxpfDTZYDe0r1IVODAs
+/C+OFWbsfYsQLWtNFbgl7y0CqfgFz2cmtT21XE27PWuA5USQ8gqwPUfA0OaEMWDx
+wM/D2RPB+LsQDpNk3lKBSgXNY7GVJNDmgFXFQhdlcE3KjX9kFbmXtLrEqUQMqGQY
+f4J44QWZXc2oWDDqs9O3B71suW9xfBhzAutjNe54yC/XFvz3Mqz+5OLXQTvVzoLO
+49F4871z6hqrWmqgXdWBTS9kW6PzEGiVKxB+tKzweq0aTK7cghVHh8ie5DsK6oFz
+mhrFsKjSEZuPr53umJDzV/X7roECGU6YW/3n7QGhZRjk5SgTwaB6gl6r8liEEP0H
+KH72le415hp1qWvBCfVmUFGOB58Rotv5w2E5mWkQ0qW/jLCX1CYCOU/fck2r2+vm
+oPX/hbt7a7iECsryrF9/XIF+Knon5FIenm/NtLIZEy4uIG/P6RHFAInEazU2aw==
 -----END CERTIFICATE-----
diff --git a/data/bc01n03.hswaw.net-kube-node.crt b/data/bc01n03.hswaw.net-kube-node.crt
index 2ab6a93..9e3eb87 100644
--- a/data/bc01n03.hswaw.net-kube-node.crt
+++ b/data/bc01n03.hswaw.net-kube-node.crt
@@ -1,34 +1,34 @@
 -----BEGIN CERTIFICATE-----
-MIIF0zCCA7sCCQCA8T/OXbv3EjANBgkqhkiG9w0BAQsFADCBtzELMAkGA1UEBhMC
-UEwxFDASBgNVBAgMC01hem93aWVja2llMREwDwYDVQQHDAhXYXJzemF3YTEuMCwG
-A1UECgwlU3Rvd2FyenlzemVuaWUgV2Fyc3phd3NraSBIYWNrZXJzcGFjZTEQMA4G
-A1UECwwHaHNjbG91ZDEaMBgGA1UEAwwRQm9vdHN0cmFwIE5vZGUgQ0ExITAfBgkq
-hkiG9w0BCQEWEnEza0BoYWNrZXJzcGFjZS5wbDAeFw0xOTAxMTIyMTM1MThaFw0x
-OTAyMTEyMTM1MThaMIGeMQswCQYDVQQGEwJQTDEUMBIGA1UECAwLTWF6b3dpZWNr
-aWUxFDASBgNVBAcMC01hem93aWVja2llMRUwEwYDVQQKDAxzeXN0ZW06bm9kZXMx
-JDAiBgNVBAsMG0t1YmVybmV0ZXMgTm9kZSBDZXJ0aWZpY2F0ZTEmMCQGA1UEAwwd
-c3lzdGVtOm5vZGU6YmMwMW4wMy5oc3dhdy5uZXQwggIiMA0GCSqGSIb3DQEBAQUA
-A4ICDwAwggIKAoICAQDEdxg8Ldm4sqSQW65riKWZjWvSP46Z41WdzCw6CvaIaNih
-M7oH3UCDjRPYCbbu+CeTVV4X4QM3d3pOOsPASo2wP3AhPWbPIacYaQXOuOUQbAr+
-UDPYCqjnywtd5f3ACBn1q4BUAXENKb9lOAMIREWv+o2smdIYuUKkQNmDHB+xg7gY
-N1kJs4ys9aS0vVR6qI2vCbmuEAS4+Cz+SUYmi5A34VGr7geEY9D+VTsYwT2uMkHz
-Qo0Hv4VjzedEUYUeBNsNj2IkQ8/+zv8Z/upsglyLA+tlNjqni8mAZ7iygIVfUgCl
-y8WLOCIjBFWRA6IB/G3p9MwLbDfTeyJl0KKVmZi58uRyax5IDB3noBoSBnfXkmW2
-QjDCoMqlvSi6TPBv3Gve2vH3S3wMaFakIlvvt5ADacAE2raZXbG8LgNR/tgRreLe
-9Nlqa7Z7zPQsYgk1xptJ8QMAOKJzFUnNYZlo9NG9FhmJkwKxImIADyJYBbmyR9Qj
-pMcB0zrzY6VTnGpzmz722t4RCn8vKtm4FvyBu32UY95BL2PR50OWYcNJAAiTGaD6
-tFBNc9IHj7/bwm7NUYALaoVA9PkT77NgOIIimCKIDS3x4ykHZe/Rvzk0DBS59K3V
-ZhunqgMiL+kRQ9hCh93rmnRmmQ+1zLUZlyE4LH49qp6cWH3XRcjbi26aBrdJiwID
-AQABMA0GCSqGSIb3DQEBCwUAA4ICAQCSBRuOZkN198iEfpKEFgqObgY4wYx8mOOS
-k/XkQ0c1wlDFeFN0mBiMhLlrpeXPk07FQxsAZDxOiWy2b7j1mWzba6uUhFxn9Elb
-S4d6VmdnITuu/HsgPsRFFkoYZOX55SgrRJfyGUOQ34ZvgXXT8acc+qxN4sQfs4lt
-yoScgO3ir1b4CHkEl4hN4JVTZ1k7AiVvZtKAjD1GnH5L+wr+/EuvBlakxapcPuQ9
-Ec5t5xcNmzjJazswe3eMLic2exMPF3xifg95XBT3xITx3L45oKLKyHbV1IosnJDp
-61wOR567aVF4KAS0TcKKBMtE3H131FZenJt5AR3RvX1i4DZb9yeSEuAnp/QWcGL+
-Mnzh1/x3QW7RtCKYd5J+EwBnyWgGdEjfQgbqV4LlAjzTDc4/rVyY3f5Y09IcHPou
-oFFmW4+BeOLMNYOHC0l5qt1l2qSG/3qa8P8UB4C1eNOUSCQoG7Sob07ccE7ACBgD
-BQ8Rge1ko953XNyfT6zq69PcM1cAwtzSqNuaVR0Oy2COkHMZZwklBOKNavAtx6z4
-o29LXc6DSuBfFTDThqnXhaeHoWNQn8N9MWu+r5rdnneGS5Gzb1YEV6TeSRKSgEI4
-3FdXirf9PehrkB79VZPOectVdh46RKovfzj1Oh9w9uDRsCuUIYuJToxyvBJ/Gt1w
-ksA9E7w+mg==
+MIIF+jCCA+KgAwIBAgIJAIDxP85du/ceMA0GCSqGSIb3DQEBCwUAMIG3MQswCQYD
+VQQGEwJQTDEUMBIGA1UECAwLTWF6b3dpZWNraWUxETAPBgNVBAcMCFdhcnN6YXdh
+MS4wLAYDVQQKDCVTdG93YXJ6eXN6ZW5pZSBXYXJzemF3c2tpIEhhY2tlcnNwYWNl
+MRAwDgYDVQQLDAdoc2Nsb3VkMRowGAYDVQQDDBFCb290c3RyYXAgTm9kZSBDQTEh
+MB8GCSqGSIb3DQEJARYScTNrQGhhY2tlcnNwYWNlLnBsMB4XDTE5MDExMzAzMzIz
+MloXDTE5MDIxMjAzMzIzMlowgZ4xCzAJBgNVBAYTAlBMMRQwEgYDVQQIDAtNYXpv
+d2llY2tpZTEUMBIGA1UEBwwLTWF6b3dpZWNraWUxFTATBgNVBAoMDHN5c3RlbTpu
+b2RlczEkMCIGA1UECwwbS3ViZXJuZXRlcyBOb2RlIENlcnRpZmljYXRlMSYwJAYD
+VQQDDB1zeXN0ZW06bm9kZTpiYzAxbjAzLmhzd2F3Lm5ldDCCAiIwDQYJKoZIhvcN
+AQEBBQADggIPADCCAgoCggIBAMR3GDwt2biypJBbrmuIpZmNa9I/jpnjVZ3MLDoK
+9oho2KEzugfdQIONE9gJtu74J5NVXhfhAzd3ek46w8BKjbA/cCE9Zs8hpxhpBc64
+5RBsCv5QM9gKqOfLC13l/cAIGfWrgFQBcQ0pv2U4AwhERa/6jayZ0hi5QqRA2YMc
+H7GDuBg3WQmzjKz1pLS9VHqoja8Jua4QBLj4LP5JRiaLkDfhUavuB4Rj0P5VOxjB
+Pa4yQfNCjQe/hWPN50RRhR4E2w2PYiRDz/7O/xn+6myCXIsD62U2OqeLyYBnuLKA
+hV9SAKXLxYs4IiMEVZEDogH8ben0zAtsN9N7ImXQopWZmLny5HJrHkgMHeegGhIG
+d9eSZbZCMMKgyqW9KLpM8G/ca97a8fdLfAxoVqQiW++3kANpwATatpldsbwuA1H+
+2BGt4t702WprtnvM9CxiCTXGm0nxAwA4onMVSc1hmWj00b0WGYmTArEiYgAPIlgF
+ubJH1COkxwHTOvNjpVOcanObPvba3hEKfy8q2bgW/IG7fZRj3kEvY9HnQ5Zhw0kA
+CJMZoPq0UE1z0gePv9vCbs1RgAtqhUD0+RPvs2A4giKYIogNLfHjKQdl79G/OTQM
+FLn0rdVmG6eqAyIv6RFD2EKH3euadGaZD7XMtRmXITgsfj2qnpxYfddFyNuLbpoG
+t0mLAgMBAAGjIDAeMBwGA1UdEQQVMBOCEWJjMDFuMDMuaHN3YXcubmV0MA0GCSqG
+SIb3DQEBCwUAA4ICAQBI1haT3MZehODqbPhhKAPErpu2AgoKlDMAFEztSWfH3uW6
+uaX07rlcPMvI13dzkducpL0ha+qVCodL3oAd3Jf7r738uD0nFaiamaGVoepkIfZE
+8wfAHS/c9T+iXiG8FArfE+dOBHYt5LFwq+BSyw0uRjRTquF6AeZr5SHrzsCDkFQk
+75z2PhciGUHYCk2vv2VGQvg0SkowqegrywWb/yTbAPgBsjZwQ4hmGXDfbJUa7Kga
+G2CuI6gRWA2bakfdDnNUqz4Qqn3jis1Qv05NCGCQlfJNVMmIZlrGpG3GUgVBbyMi
+Z8ELMKAIhSNSAYo4eZqyDIztRyGD2wEpxE2A+K9RgvNs+ocFgLTOQVji50NWS6t/
+opDVjZ5tbNUsVuEXdmNcis1yq5hniFwxrWUIxDwGaEAwyCRZbV0WuqgUwEGIOzHo
+6Yzv6EyHXqJCOubET42Gr5Ujc10zJpZ7oizBNQhuQvaahTKqPgew2QE8MDKmRzZm
+F3xgXNQj0jnoJJi1QUmjXANtN7/elz6hxu4HkXDkTCMtqjzGzrdZjLss+gBNLLhe
+1xBr3MD9R7XoFxyZFGCEHWiQ1Zdzw+ULai205/kZUFyNpxTK7Yt1I63oHj8HrVB6
+wLM/ibtK/TOtB5cbyYRCETYXeSe21m2hvc2RvZUKgxZ0gS28oYM7OET5s2J8ew==
 -----END CERTIFICATE-----
diff --git a/data/ca.srl b/data/ca.srl
index 6a1633e..3469067 100644
--- a/data/ca.srl
+++ b/data/ca.srl
@@ -1 +1 @@
-80F13FCE5DBBF715
+80F13FCE5DBBF71E
diff --git a/data/openssl.cnf b/data/openssl.cnf
new file mode 100644
index 0000000..1e5cc2e
--- /dev/null
+++ b/data/openssl.cnf
@@ -0,0 +1,350 @@
+#
+# OpenSSL example configuration file.
+# This is mostly being used for generation of certificate requests.
+#
+
+# This definition stops the following lines choking if HOME isn't
+# defined.
+HOME			= .
+RANDFILE		= $ENV::HOME/.rnd
+
+# Extra OBJECT IDENTIFIER info:
+#oid_file		= $ENV::HOME/.oid
+oid_section		= new_oids
+
+# To use this configuration file with the "-extfile" option of the
+# "openssl x509" utility, name here the section containing the
+# X.509v3 extensions to use:
+# extensions		= 
+# (Alternatively, use a configuration file that has only
+# X.509v3 extensions in its main [= default] section.)
+
+[ new_oids ]
+
+# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
+# Add a simple OID like this:
+# testoid1=1.2.3.4
+# Or use config file substitution like this:
+# testoid2=${testoid1}.5.6
+
+# Policies used by the TSA examples.
+tsa_policy1 = 1.2.3.4.1
+tsa_policy2 = 1.2.3.4.5.6
+tsa_policy3 = 1.2.3.4.5.7
+
+####################################################################
+[ ca ]
+default_ca	= CA_default		# The default ca section
+
+####################################################################
+[ CA_default ]
+
+dir		= ./demoCA		# Where everything is kept
+certs		= $dir/certs		# Where the issued certs are kept
+crl_dir		= $dir/crl		# Where the issued crl are kept
+database	= $dir/index.txt	# database index file.
+#unique_subject	= no			# Set to 'no' to allow creation of
+					# several ctificates with same subject.
+new_certs_dir	= $dir/newcerts		# default place for new certs.
+
+certificate	= $dir/cacert.pem 	# The CA certificate
+serial		= $dir/serial 		# The current serial number
+crlnumber	= $dir/crlnumber	# the current crl number
+					# must be commented out to leave a V1 CRL
+crl		= $dir/crl.pem 		# The current CRL
+private_key	= $dir/private/cakey.pem# The private key
+RANDFILE	= $dir/private/.rand	# private random number file
+
+x509_extensions	= usr_cert		# The extentions to add to the cert
+
+# Comment out the following two lines for the "traditional"
+# (and highly broken) format.
+name_opt 	= ca_default		# Subject Name options
+cert_opt 	= ca_default		# Certificate field options
+
+# Extension copying option: use with caution.
+copy_extensions = copy
+
+# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
+# so this is commented out by default to leave a V1 CRL.
+# crlnumber must also be commented out to leave a V1 CRL.
+# crl_extensions	= crl_ext
+
+default_days	= 365			# how long to certify for
+default_crl_days= 30			# how long before next CRL
+default_md	= default		# use public key default MD
+preserve	= no			# keep passed DN ordering
+
+# A few difference way of specifying how similar the request should look
+# For type CA, the listed attributes must be the same, and the optional
+# and supplied fields are just that :-)
+policy		= policy_match
+
+# For the CA policy
+[ policy_match ]
+countryName		= match
+stateOrProvinceName	= match
+organizationName	= match
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+# For the 'anything' policy
+# At this point in time, you must list all acceptable 'object'
+# types.
+[ policy_anything ]
+countryName		= optional
+stateOrProvinceName	= optional
+localityName		= optional
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+####################################################################
+[ req ]
+default_bits		= 2048
+default_keyfile 	= privkey.pem
+distinguished_name	= req_distinguished_name
+attributes		= req_attributes
+x509_extensions	= v3_ca	# The extentions to add to the self signed cert
+
+# Passwords for private keys if not present they will be prompted for
+# input_password = secret
+# output_password = secret
+
+# This sets a mask for permitted string types. There are several options. 
+# default: PrintableString, T61String, BMPString.
+# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
+# utf8only: only UTF8Strings (PKIX recommendation after 2004).
+# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
+# MASK:XXXX a literal mask value.
+# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
+string_mask = utf8only
+
+# req_extensions = v3_req # The extensions to add to a certificate request
+
+[ req_distinguished_name ]
+countryName			= Country Name (2 letter code)
+countryName_default		= AU
+countryName_min			= 2
+countryName_max			= 2
+
+stateOrProvinceName		= State or Province Name (full name)
+stateOrProvinceName_default	= Some-State
+
+localityName			= Locality Name (eg, city)
+
+0.organizationName		= Organization Name (eg, company)
+0.organizationName_default	= Internet Widgits Pty Ltd
+
+# we can do this but it is not needed normally :-)
+#1.organizationName		= Second Organization Name (eg, company)
+#1.organizationName_default	= World Wide Web Pty Ltd
+
+organizationalUnitName		= Organizational Unit Name (eg, section)
+#organizationalUnitName_default	=
+
+commonName			= Common Name (e.g. server FQDN or YOUR name)
+commonName_max			= 64
+
+emailAddress			= Email Address
+emailAddress_max		= 64
+
+# SET-ex3			= SET extension number 3
+
+[ req_attributes ]
+challengePassword		= A challenge password
+challengePassword_min		= 4
+challengePassword_max		= 20
+
+unstructuredName		= An optional company name
+
+[ usr_cert ]
+
+# These extensions are added when 'ca' signs a request.
+
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+
+basicConstraints=CA:FALSE
+
+# Here are some examples of the usage of nsCertType. If it is omitted
+# the certificate can be used for anything *except* object signing.
+
+# This is OK for an SSL server.
+# nsCertType			= server
+
+# For an object signing certificate this would be used.
+# nsCertType = objsign
+
+# For normal client use this is typical
+# nsCertType = client, email
+
+# and for everything including object signing:
+# nsCertType = client, email, objsign
+
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+# This will be displayed in Netscape's comment listbox.
+nsComment			= "OpenSSL Generated Certificate"
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+# An alternative to produce certificates that aren't
+# deprecated according to PKIX.
+# subjectAltName=email:move
+
+# Copy subject details
+# issuerAltName=issuer:copy
+
+#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
+#nsBaseUrl
+#nsRevocationUrl
+#nsRenewalUrl
+#nsCaPolicyUrl
+#nsSslServerName
+
+# This is required for TSA certificates.
+# extendedKeyUsage = critical,timeStamping
+
+[ v3_req ]
+
+# Extensions to add to a certificate request
+
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+[ v3_ca ]
+
+
+# Extensions for a typical CA
+
+
+# PKIX recommendation.
+
+subjectKeyIdentifier=hash
+
+authorityKeyIdentifier=keyid:always,issuer
+
+# This is what PKIX recommends but some broken software chokes on critical
+# extensions.
+#basicConstraints = critical,CA:true
+# So we do this instead.
+basicConstraints = CA:true
+
+# Key usage: this is typical for a CA certificate. However since it will
+# prevent it being used as an test self-signed certificate it is best
+# left out by default.
+# keyUsage = cRLSign, keyCertSign
+
+# Some might want this also
+# nsCertType = sslCA, emailCA
+
+# Include email address in subject alt name: another PKIX recommendation
+# subjectAltName=email:copy
+# Copy issuer details
+# issuerAltName=issuer:copy
+
+# DER hex encoding of an extension: beware experts only!
+# obj=DER:02:03
+# Where 'obj' is a standard or added object
+# You can even override a supported extension:
+# basicConstraints= critical, DER:30:03:01:01:FF
+
+[ crl_ext ]
+
+# CRL extensions.
+# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
+
+# issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always
+
+[ proxy_cert_ext ]
+# These extensions should be added when creating a proxy certificate
+
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+
+basicConstraints=CA:FALSE
+
+# Here are some examples of the usage of nsCertType. If it is omitted
+# the certificate can be used for anything *except* object signing.
+
+# This is OK for an SSL server.
+# nsCertType			= server
+
+# For an object signing certificate this would be used.
+# nsCertType = objsign
+
+# For normal client use this is typical
+# nsCertType = client, email
+
+# and for everything including object signing:
+# nsCertType = client, email, objsign
+
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+# This will be displayed in Netscape's comment listbox.
+nsComment			= "OpenSSL Generated Certificate"
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+# An alternative to produce certificates that aren't
+# deprecated according to PKIX.
+# subjectAltName=email:move
+
+# Copy subject details
+# issuerAltName=issuer:copy
+
+#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
+#nsBaseUrl
+#nsRevocationUrl
+#nsRenewalUrl
+#nsCaPolicyUrl
+#nsSslServerName
+
+# This really needs to be in place for it to be a proxy certificate.
+proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
+
+####################################################################
+[ tsa ]
+
+default_tsa = tsa_config1	# the default TSA section
+
+[ tsa_config1 ]
+
+# These are used by the TSA reply generation only.
+dir		= ./demoCA		# TSA root directory
+serial		= $dir/tsaserial	# The current serial number (mandatory)
+crypto_device	= builtin		# OpenSSL engine to use for signing
+signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
+					# (optional)
+certs		= $dir/cacert.pem	# Certificate chain to include in reply
+					# (optional)
+signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
+
+default_policy	= tsa_policy1		# Policy if request did not specify it
+					# (optional)
+other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
+digests		= md5, sha1		# Acceptable message digests (mandatory)
+accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
+clock_precision_digits  = 0	# number of digits after dot. (optional)
+ordering		= yes	# Is ordering defined for timestamps?
+				# (optional, default: no)
+tsa_name		= yes	# Must the TSA name be included in the reply?
+				# (optional, default: no)
+ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
+				# (optional, default: no)
diff --git a/env.sh b/env.sh
index 73696a8..e58c0de 100644
--- a/env.sh
+++ b/env.sh
@@ -59,14 +59,24 @@
         ca="$secrets/ca.key"
         [ ! -f "$ca" ] && ( scripts/secretstore decrypt "$secrets/cipher/ca.key" > $ca )
 
-        ssh root@$fqdn -- nix-shell -p openssl --command "\"openssl req -new -key /opt/hscloud/${certname}.key -out /opt/hscloud/${certname}.csr -subj '${subj}'\""
+        cp data/openssl.cnf san.cnf
+        echo -ne "\n[SAN]\nsubjectAltName=DNS:${fqdn}" >> san.cnf
+        scp san.cnf root@$fqdn:/opt/hscloud/san.cnf
+
+        ssh root@$fqdn -- nix-shell -p openssl --command "\"openssl req -new -key /opt/hscloud/${certname}.key -out /opt/hscloud/${certname}.csr -subj '${subj}' -config /opt/hscloud/san.cnf -reqexts SAN\""
         scp root@$fqdn:/opt/hscloud/${certname}.csr ${fqdn}-${certname}.csr
-        openssl x509 -req -in ${fqdn}-${certname}.csr -CA data/ca.crt -CAkey "$ca" -CAcreateserial -out "data/${fqdn}-${certname}.crt"
+        openssl x509 -req \
+                -in ${fqdn}-${certname}.csr \
+                -CA data/ca.crt \
+                -CAkey "$ca" -CAcreateserial \
+                -out "data/${fqdn}-${certname}.crt" \
+                -extensions SAN -extfile san.cnf
 
         scp "data/${fqdn}-${certname}.crt" root@$fqdn:/opt/hscloud/${certname}.crt
         scp "data/ca.crt" root@$fqdn:/opt/hscloud/ca.crt
         ssh root@$fqdn -- chmod 444 /opt/hscloud/${certname}.crt /opt/hscloud/ca.crt
         rm ${fqdn}-${certname}.csr
+        rm san.cnf
     )
 }
 
@@ -137,8 +147,64 @@
     )
 }
 
+hscloud-k8s-config() {
+    (
+        set -e
+
+        if [ -z "$1" ]; then
+            echo >&2 "Usage: hscloud-k8s-config username"
+            exit 1
+        fi
+        username="$1"
+
+        cd "$hscloud_root"
+        mkdir -p .kubectl
+
+        cert="$hscloud_root/.kubectl/client.crt"
+        csr="$hscloud_root/.kubectl/client.csr"
+        keyfile="$hscloud_root/.kubectl/client.key"
+        secrets="$hscloud_root/secrets"
+        ca="$secrets/ca.key"
+
+        if [ ! -f "$keyfile" ]; then
+            echo "Generating ${keyfile}..."
+            openssl genrsa -out $keyfile 4096
+            rm -f "$cert"
+        fi
+        if [ ! -f "$cert" ]; then
+            echo "Signing ${cert}..."
+            [ ! -f "$ca" ] && ( scripts/secretstore decrypt "$secrets/cipher/ca.key" > $ca )
+            openssl req -new -key "${keyfile}" -out "${csr}" -subj "/C=PL/ST=Mazowieckie/O=system:masters/OU=Kubernetes Admin Account for ${username}/CN=${username}"
+            openssl x509 -req -in "${csr}" -CA data/ca.crt -CAkey "$ca" -CAcreateserial -out "${cert}"
+        fi
+
+        kubeconfig="$hscloud_root/.kubectl/client.kubeconfig"
+        echo "Generating ${kubeconfig}..."
+        rm -rf ${kubeconfig}
+
+        kubectl config set-cluster k0.hswaw.net \
+          --certificate-authority=${hscloud_root}/data/ca.crt \
+          --embed-certs=true \
+          --server=https://k0.hswaw.net:4001 \
+          --kubeconfig=${kubeconfig}
+
+        kubectl config set-credentials ${username} \
+          --client-certificate=${cert} \
+          --client-key=${keyfile} \
+          --embed-certs=true \
+          --kubeconfig=${kubeconfig}
+
+        kubectl config set-context default \
+          --cluster=k0.hswaw.net \
+          --user=${username} \
+          --kubeconfig=${kubeconfig}
+
+        kubectl config use-context default --kubeconfig=${kubeconfig}
+    )
+}
+
 echo "Now playing:"
-echo "  hscloud-dc      - run docker-compose"
-echo "  hscloud-pki-dev - generate dev PKI certs"
-echo "  hscloud-node-push-certs - push a node cert to the node"
+echo "  hscloud-dc         - run docker-compose"
+echo "  hscloud-pki-dev    - generate dev PKI certs"
+echo "  hscloud-node-certs - ensure node has required certs"
 echo ""