CLI works (but HubCertificates aren't actually issued)