def certificate_factory(user=None, **kwargs):
    if user is None:
        user = user_factory()

    kwargs.setdefault("fingerprint", f"fingerprint_{gen_id()}")
    kwargs.setdefault("subject", f"CN={gen_id()}")
    kwargs.setdefault("not_valid_before_utc", datetime.utcnow() - timedelta(days=1))
    kwargs.setdefault("not_valid_after_utc", datetime.utcnow() + timedelta(days=1))
    return Certificate.create(user=user, **kwargs)
def migrate_certificates(migrator):
    users = list(User.select())

    active_users = {}
    for user in users:
        active_users.setdefault(user.username, user)
        watered_at = active_users[user.username].plant.watered_at
        if user.plant.watered_at > watered_at:
            active_users[user.username] = user

    for user in users:
        active_user = active_users[user.username]
        Certificate.create(
            user=active_user,
            authorised=not user.user_id.endswith("="),
            fingerprint=user.user_id,
            cn=user.username,
        )
        if user == active_user:
            user.user_id = gen_user_id()
            user.save()
        else:
            user.delete_instance()