What about certctl.conf in the etc set defaulting to "manual" and sysinst (optionally?) changing it to automatic mode? Of course, then, updating to -10 wouldn't give you automatic mode.