I save CA root into private github repo for the pass app. Then i can sign certs whenever i need them.