Cherry pick the use of CertifiedClientRole from local-dev branch