fixes for multiple certs per CA