• Implement initial handshake that setups certificates in GW (if it doesn't already have certificates)
• Implement in GW to create CSRs
• Persist all certificates/keys in GW
• Make sure that when core/GW restarts after certificate setup, the communication automatically switches to HTTPS and skips the handshaking phase
• Handle graceful restart of either Core or Proxy
• Prevent issuing new certificate for gateway that already had certificate issued
• Error handling in Gateway, consider edge cases
• Error handling in Core, consider edge cases
• Authorize GW/Proxy with SSL certificates (bind Certificate with the instance of the gw/proxy) - no more need for GW tokens...

Result: Connect new Gateway to a Core with custom CA, components exchange data over HTTPS (logs), text files with certificates got created. Connect to the Gateway, stats should be published over HTTPS.