control-enable is used, our standard configuration is using unix domain sockets without certs. existing setups with already-created certificates are ok, if somebody needs remote+certs they can generate keys themself. ok florian@