Looks like certmaster-request and certmaster-ca are working with the new --ca flag.