As discussed on IRC, the correct solution is not to copy certificates around wildly; it's to implement the API discussed on bug 29018.
As discussed on IRC, the correct solution is not to copy certificates around wildly; it's to implement the API discussed on bug 29018.