To copy my comments from earlier, this uses the internal properties of the CA object which tightly ties this test to the internal APIs of the CA. This is being done so that we can easily generate a new key/cert pair, correct? If that's the case, is there any way we can use public APIs to do this?