place certs into subdirs by service type