It will work again without +ExportCertData, so I'm fine backing that out; I was considering it a flaw of the external ca setup.