CMP client: fix checking new cert enrolled with oldcert and without private key