That sounds better. From wikipedia:

"Four terms always associated with the command pattern are command, receiver, invoker and client. A command object has a receiver object and invokes a method of the receiver in a way that is specific to that receiver's class. The receiver then does the work. A command object is separately passed to an invoker object, which invokes the command, and optionally does bookkeeping about the command execution. Any command object can be passed to the same invoker object. Both an invoker object and several command objects are held by a client object. The client contains the decision making about which commands to execute at which points. To execute a command, it passes the command object to the invoker object. See example code below."

Cert in "CertManager" is also odd. So maybe something like:

BaseCertManager becomes  Client [or CommandClient?]
EntitlementCertManager becomes EntCertCommandClient
the entcertlib.EntCertLib class  becomes  EntCertInvoker [or EntCertUpdateInvoker?]
entcertlib.EntCertUpdateAction class becomes EntCertUpdateCommand

Doesn't seem to be an equiv of a Receiver in this imp  (I guess EntDirectory would be the receiver in that pattern, but we inject that).

Better than Lib/Manager. Command/client are kind of already overload though,