anchor.diff:              do_generate_local_cert(CertPEM, PKeyPEM, Node)
       end.
   
  -save_cert_pkey(CertPEM, PKeyPEM, Compat30, Node) ->
  +apply_node_cert_data(Data) ->
       Path = ssl_cert_key_path(),
  -    case Compat30 of
  -        true ->
  -            {LocalCert, LocalPKey} = maybe_generate_local_cert(CertPEM, PKeyPEM, Node),
  -            ok = misc:atomic_write_file(Path, [LocalCert, LocalPKey]),
  -            ok = misc:atomic_write_file(raw_ssl_cacert_key_path(), CertPEM),
  -            ok = misc:atomic_write_file(memcached_cert_path(), [LocalCert, CertPEM]),
  -            ok = misc:atomic_write_file(memcached_key_path(), LocalPKey);
  -        false ->
  -            _ = file:delete(raw_ssl_cacert_key_path()),
  -            ok = misc:atomic_write_file(Path, [CertPEM, PKeyPEM]),
  -            ok = misc:atomic_write_file(memcached_cert_path(), CertPEM),
  -            ok = misc:atomic_write_file(memcached_key_path(), PKeyPEM)
  -    end,
  -
  +    apply_node_cert_data(Data, Path),
       ok = ssl_manager:clear_pem_cache().
  +
  +apply_node_cert_data({generated, CertPEM, PKeyPEM, true, Node}, Path) ->
  +    {LocalCert, LocalPKey} = maybe_generate_local_cert(CertPEM, PKeyPEM, Node),
  +    ok = misc:atomic_write_file(Path, [LocalCert, LocalPKey]),
  +    ok = misc:atomic_write_file(raw_ssl_cacert_key_path(), CertPEM),
  +    ok = misc:atomic_write_file(memcached_cert_path(), [LocalCert, CertPEM]),
  +    ok = misc:atomic_write_file(memcached_key_path(), LocalPKey);
  +apply_node_cert_data({generated, CertPEM, PKeyPEM, false, _Node}, Path) ->
  +    _ = file:delete(raw_ssl_cacert_key_path()),
  +    ok = misc:atomic_write_file(Path, [CertPEM, PKeyPEM]),
  +    ok = misc:atomic_write_file(memcached_cert_path(), CertPEM),
  +    ok = misc:atomic_write_file(memcached_key_path(), PKeyPEM);
  +apply_node_cert_data({user_set, Cert, PKey, CAChain}, Path) ->
  +    ok = misc:atomic_write_file(Path, [Cert, PKey]),
  +    ok = misc:atomic_write_file(raw_ssl_cacert_key_path(), CAChain),
  +    ok = misc:atomic_write_file(memcached_cert_path(), [Cert, CAChain]),
  +    ok = misc:atomic_write_file(memcached_key_path(), PKey).
   
   all_services() ->
       [ssl_service, capi_ssl_service, xdcr_proxy, query_svc, memcached].
  
positive.code: set_node_certificate_chain(Props, CAChain, Cert, PKey) ->
      gen_server:call(?MODULE, {set_node_certificate_chain, Props, CAChain, Cert, PKey}, infinity).
  
  build_cert_state(CertPEM, PKeyPEM, Compat30, Node) ->
      BaseState = #cert_state{cert = CertPEM,
                              pkey = PKeyPEM,
                              compat_30 = Compat30},
  
negative.code: 
  handle_info(cert_and_pkey_changed, #state{cert_state = OldCertState} = State) ->
      misc:flush(cert_and_pkey_changed),
  
      Data = get_node_cert_data(),
      NewCertState = build_cert_state(Data),
      case OldCertState =:= NewCertState of
          true ->
              {noreply, State};
          false ->
              ?log_info("Got certificate and pkey change"),
              misc:create_marker(marker_path()),
              apply_node_cert_data(Data),
              ?log_info("Wrote new pem file"),
              self() ! notify_services,
              {noreply, #state{cert_state = NewCertState,
  