Notes on generating certificates from an internal CA