When a new certificate is installed, allocate a new ssl_ctx and bind to it; then...