domain fact trick doesn't work when the CA is in a different domain from...

... the tenant