This read-write enumerated scalar triggers one of four certificate operations when set: generating an RSA key with a self-signed certificate, generating just a self-signed certificate, generating a PKCS12 bundle, or generating a certificate request. Admins use it as the action trigger after populating the various rlSslCertificateGeneration* subject fields, since those fields alone don't cause anything to happen until this object is written. For example, an admin sets this to generateCertificateRequest(4) after filling in the common name and organization fields, producing a CSR to submit to a public CA.