i don't think we really need the CA, just use same cert for everything, cert won't verify anyway so host doesn't have to match