BTW, dead thread, I should note that the certs Conveyor generates aren't CA certificates. They have your chosen identity name in them, so you can't use it to sign for other packages.