Separate TLS certificate for listener