don't download certificate on refresh but do that only in the request wizard; add (back) CA method to check if certificate is present