allow initial provision of CA