anchor.diff:  
   handle_info(cert_and_pkey_changed, #state{cert_state = OldCertState} = State) ->
       misc:flush(cert_and_pkey_changed),
  -    {CertPEM, PKeyPEM} = ns_server_cert:cluster_cert_and_pkey_pem(),
  -    Compat30 = cluster_compat_mode:is_cluster_30(),
  -    Node = node(),
  -    NewCertState = build_cert_state(CertPEM, PKeyPEM, Compat30, Node),
  +
  +    Data = get_node_cert_data(),
  +    NewCertState = build_cert_state(Data),
       case OldCertState =:= NewCertState of
           true ->
               {noreply, State};
           false ->
               ?log_info("Got certificate and pkey change"),
               misc:create_marker(marker_path()),
  -            save_cert_pkey(CertPEM, PKeyPEM, Compat30, Node),
  +            apply_node_cert_data(Data),
               ?log_info("Wrote new pem file"),
               self() ! notify_services,
               {noreply, #state{cert_state = NewCertState,
  
positive.code:             do_generate_local_cert(CertPEM, PKeyPEM, Node)
      end.
  
  save_cert_pkey(CertPEM, PKeyPEM, Compat30, Node) ->
      Path = ssl_cert_key_path(),
      case Compat30 of
          true ->
              {LocalCert, LocalPKey} = maybe_generate_local_cert(CertPEM, PKeyPEM, Node),
              ok = misc:atomic_write_file(Path, [LocalCert, LocalPKey]),
              ok = misc:atomic_write_file(raw_ssl_cacert_key_path(), CertPEM),
              ok = misc:atomic_write_file(memcached_cert_path(), [LocalCert, CertPEM]),
              ok = misc:atomic_write_file(memcached_key_path(), LocalPKey);
          false ->
              _ = file:delete(raw_ssl_cacert_key_path()),
              ok = misc:atomic_write_file(Path, [CertPEM, PKeyPEM]),
              ok = misc:atomic_write_file(memcached_cert_path(), CertPEM),
              ok = misc:atomic_write_file(memcached_key_path(), PKeyPEM)
      end,
  
      ok = ssl_manager:clear_pem_cache().
  
  all_services() ->
      [ssl_service, capi_ssl_service, xdcr_proxy, query_svc, memcached].
  
negative.code:                    false ->
                         []
                 end,
      {ok, #state{cert_state = build_cert_state(Data), reload_state = RetrySvc}}.
  
  format_status(_Opt, [_PDict, #state{cert_state = CertState} = State]) ->
      State#state{cert_state = CertState#cert_state{pkey = <<"sanitized">>}}.
  