diff --git a/install.py b/install.py
index 0457b50..289bab4 100755
--- a/install.py
+++ b/install.py
@@ -17,6 +17,7 @@ import types
 import socket
 import tempfile
 import importlib
+import ssh_cert_login
 from pathlib import Path
 from subprocess import Popen, PIPE
 from os.path import getmtime, exists
@@ -810,6 +811,7 @@ def handle_config():
             elif doit:
                 unix_cmd('systemctl stop isc-dhcp-server')
                 unix_cmd('systemctl disable isc-dhcp-server')
+        ssh_cert_login.install(doit)
         displaycfg = config.get('DISPLAY')
         if displaycfg and display_update(displaycfg):
              to_start['display'] = 'restart', True
diff --git a/utils.py b/utils.py
index 4a4966c..0c060ae 100644
--- a/utils.py
+++ b/utils.py
@@ -259,6 +259,10 @@ class MainIf:
         return self.carrier, self.ip, self.hostnameresult[0], self.gateway
 
 
+class Failure(str):
+    returncode = None
+
+
 def unix_cmd(cmd, *args, execute=None, stdout=PIPE, sudo=True):
     command = cmd.split() + list(args)
     if command[0] == 'systemctl' and not sudo:
@@ -269,14 +273,20 @@ def unix_cmd(cmd, *args, execute=None, stdout=PIPE, sudo=True):
         if execute:
             print('$', *command)
         try:
-            result = Popen(command, stdout=stdout).communicate()[0]
+            proc = Popen(command, stdout=stdout)
+            result = proc.communicate()[0]
+            output = (result or b'').decode()
+            if proc.returncode:
+                failure = Failure(output)
+                failure.returncode = proc.returncode
+                return failure
             return (result or b'').decode()
         except Exception as e:
             print(f'error {e!r}')
-        finally:
-            pass
+            return Failure(repr(e))
     else:
         print('>', *command)
+        return ''
 
 
 def check_service(service, set_on=None, execute=None, as_root=True):