- I actually like X509 and cert based auth because I have a full internal CA - pfsense and wireguard had some fucky wuckys during implementation that steered me away from it for years so now it's not as stable as I'd like - I don't know what the wireguard equivalent of CCD is but I do use CCD overrides for some stuff