major refactor to support different userowner per certificate