Upcoming intermediate changes

[jsha]

This work is done. Newly-issued certificates will be compatible with Windows XP.