do not use tmpfile to avoid needing to relable ca file