The hub will indicate its SSL settings to the robot when it "checks in". The robot will then retain this information and use it the next time it coldstarts/restarts. The are no certificates, but the communication is SSL Encrypted. The SSL Settings are configured in the hub UI, Compatibility mode will allow SSL enabled and "old" robots to connect to the hub. While SSL only will require SSL enabled components only.