Use _toCkmCertificateVector in pkcs12 client CAPIs