prepare encPMS as soon as the cert is available