allow initial SMT configuration during firstboot, incl. CA management (bnc#812930)