Treat caCertificate as base64-encoded DER rather than PEM