/var/run isn't really suitable for certificates, as it's allowed to get cleared on every boot. /var/lib would be the better alternative.