https://blog.schertz.name/2009/08/ocs-managing-ca-certs/