anchor.diff:      Self = self(),
       ns_pubsub:subscribe_link(ns_config_events, fun config_change_detector_loop/2, Self),
   
  -    {CertPEM, PKeyPEM} = ns_server_cert:cluster_cert_and_pkey_pem(),
  -    Compat30 = cluster_compat_mode:is_cluster_30(),
  -    Node = node(),
  -    save_cert_pkey(CertPEM, PKeyPEM, Compat30, Node),
  +    Data = get_node_cert_data(),
  +    apply_node_cert_data(Data),
       RetrySvc = case misc:marker_exists(marker_path()) of
                      true ->
                          Self ! notify_services,
  
positive.code: set_node_certificate_chain(Props, CAChain, Cert, PKey) ->
      gen_server:call(?MODULE, {set_node_certificate_chain, Props, CAChain, Cert, PKey}, infinity).
  
  build_cert_state(CertPEM, PKeyPEM, Compat30, Node) ->
      BaseState = #cert_state{cert = CertPEM,
                              pkey = PKeyPEM,
                              compat_30 = Compat30},
  
negative.code:             BaseState#cert_state{node = Node};
          false ->
              BaseState
      end;
  build_cert_state({user_set, Cert, PKey, CAChain}) ->
      #cert_state{cert = [Cert, CAChain],
                  pkey = PKey,
                  compat_30 = true}.
  
  read_files([], Result) ->
      lists:reverse(Result);
  read_files([Path | Rest], Result) ->
      case file:read_file(Path) of
          {ok, Content} ->
              read_files(Rest, [Content | Result]);
          Err ->
              {Err, Path}
      end.
  
  get_user_set_chain_and_pkey() ->
      Files = [user_set_cert_path(), user_set_key_path(), user_set_ca_chain_path()],
      case read_files(Files, []) of
          {Error, Path} ->
              ?log_debug("Cannot read file ~p. Error: ~p. Use generated certificate.",
                         [Path, Error]),
              use_generated;
          Contents ->
              Contents
      end.
  
  get_node_cert_data() ->
      Compat30 = cluster_compat_mode:is_cluster_30(),
      Node = node(),
      case ns_server_cert:cluster_ca() of
          {GeneratedCert, GeneratedKey} ->
              {generated, GeneratedCert, GeneratedKey, Compat30, Node};
          {_UploadedCAProps, GeneratedCert, GeneratedKey} ->
              case get_user_set_chain_and_pkey() of
                  [Cert, PKey, CAChain] ->
                      {user_set, Cert, PKey, CAChain};
                  use_generated ->
                      {generated, GeneratedCert, GeneratedKey, Compat30, Node}
              end
      end.
  
  init([]) ->
  