add sub.class1.server.ca.pem while we're at it