The random ordering means the next

pulumi up

wants to replace the cert. What I'm looking at now is adjusting the ordering in code so it matched what was previsioned previously.