You don't need to provision key for fallback cert on server, because the server simply trust all certificates that was signed by the CA. You only need to get t

You don't need to provision key for fallback cert on server, because the server simply trust all certificates that was signed by the CA. You only need to get the CA to sign the fallback cert.