CA-agnostic certificate management