add InCommon CA, simplify CA handling