When creating a new Delivery service or modifying the type to support HTTPS, a default self-signed certificate should be created. This could be triggered by a miss when looking up the DS in riak. This specifically prevents situations where a CDN could be queued by a second user unaware of a DS change in flight. This is not prevented by DS Requests since you must fulfill the DS before you could create SSL certs. If this situation happens and ORT runs an update before SSL Keys are in place, a syncds will fail.