add the ability to protect a client auth certificate by a randomly generated password.