In Table A.6. CertificateUsers Module Options there is option hashStorePassword with "true" default value, but default value is "false".
Verified on stage.