huge changes for CA management — client still fails for now