It's the endpoint wizard.  If you create the endpoints manually, the certificate references are not created.