diff --git a/Gemfile b/Gemfile
index ef021ba..30aef49 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,2 +1,3 @@
 source 'https://rubygems.org'
+gem 'base64'
 gem 'rubocop', '= 1.25.1'
diff --git a/chefctl/src/chefctl.rb b/chefctl/src/chefctl.rb
index 83759c1..13d0ad2 100755
--- a/chefctl/src/chefctl.rb
+++ b/chefctl/src/chefctl.rb
@@ -170,6 +170,9 @@ module Config
     # See Chefctl::Plugin.rerun_chef?
     max_retries 1
 
+    # where to find certs and configs
+    client_config_dir '/etc/chef'
+
     # The testing timestamp.
     # See https://github.com/facebook/taste-tester
     testing_timestamp '/etc/chef/test_timestamp'
@@ -249,7 +252,7 @@ def hostname
     # them if necessary.
     # The return value is ignored.
     def generate_certs
-      client_prod_cert = '/etc/chef/client-prod.pem'
+      client_prod_cert = "#{Chefctl::Config.client_config_dir}/client-prod.pem"
       if File.zero?(client_prod_cert)
         Chefctl.logger.info('zero-byte client pem found, removing')
         File.unlink(client_prod_cert)