Is there a specific requirement not to use external certificate providers if it can be automated as well?