allow CA public key renewal