No longer scratch ca key when generating certificates