"Running a CA" is pretty much dominated by managing certificates? Including distribution and revocation - not just issuing?