No, they can be created on the fly. That basically makes it a TLS signing Oracle.