use a root cert to create new cert dynamically