Function ensure 

pub fn ensure(
    hosts: &[String],
    days: u32,
    cert_path: &str,
    key_path: &str,
) -> Result<bool>

Ensure a certificate exists at cert_path/key_path, generating a self-signed one if not.

Generation is skipped when a certificate is already on disk, so a restart reuses the existing keypair rather than handing every client a new identity to be surprised by. Returns true if a certificate was generated on this call.

Single-process by design. The check and the write are not guarded by a cross-process lock, so replicas booting simultaneously against the same writable path can each decide to generate. Each file lands atomically (see [stage] and [publish]), so nobody reads a half-written one, but the replicas can end up serving different certificates, or one can fail to start on a cert/key pair from two different runs.

Whether a lock would help depends on the storage, so be precise about it. On shared storage a lock spanning the existence check and both writes would work: the first replica generates, the rest find a complete pair and reuse it, and they end up with one identity. On per-replica storage it cannot — there is nothing to coordinate through, and each replica necessarily holds a different self-signed identity. Since the second case has no fix at this layer and the first is better solved by not generating at boot at all, the documented answer for either is to generate once with edgeguard cert and mount the result read-only. First-boot generation targets the single-instance case it was added for.