refactored CA service for different certificate roles