When you install a 12.0 (and following) master it will generate unique certs. These certs will be packed in rollouts configurations and the console you'll install on the master will have the path to the ../master/bin/certs folder.
Certs will also be packed when you'll download the java webstart console.
The problem is that when you will install a "heavy" console the certs are neither packed with the installer, even if you download if from the http(s)://master:port/console section "Installing the console via a standard installation package (less common)" and the installer will not warn you about the certs.
Problem is you will not be able to connect to the master using the "heavy" console you just installed on your computer until you will have copied the ../master/bin/certs/trusted folder from your master in the console path ../console/certs (see section "Install cert for MSI installed console" of this KB article for more details)
This need to either be packed with the installer when you download it from the page or be requested/notified by the installer.