Fix CA cert

Adds a one-off exec that runs certutil on the new itcCA cert.