new recipe: client root CA on windows XP