Separated CA and server certs