convert keystone certs only with PKI