get rid of labels, we only need the trusted one
add configCertsDir for things we need to keep
remove tmpdir when we're done with it