HI Richard,
I have also struggled habit with working this out. We issue the certificate by restricting access based on completion of an attendance activity. Generally this works well in any case where you are about apply a restriction.
I still have not worked out what logic is applied to teachers being able see students certificates but not having one generated for themselves. I have just embarrassed myself by sending out a batch of certificates to teachers by granting them access to them.
Any helpful answers would be most welcome.
Rob