using options.caCert for code_cert