I suspect he'd be happier with Cryptlib. It's a much saner toolkit, and already has most of a CA built in.