CertUtil: perfer *.XXXX cert file