Do we need the first entcertlib call?  Shouldn't we be able to get rid of that, and only run the last one?