certificate_authorities can be empty on certificateRequest