Yeah, there are definitely cases where you can't swap out certs and all that, but in those cases the automated tools just fall down anyway. I don't miss the days of manually compiling OpenSSL with specific flags to generate just the right FLIRT symbols to find the methods I needed to hook.