So you went from a working system and then changed everything for the switch authentication. Why? Why didn't you just keep the same AAA backend? Either way, if you want to use 2 different certs and CAs then you'll need 2 instances.... or proxy the other ones off to eg microsd NPS server..but again, why? alan