Internal certificate operations