This ended up not being the this code. The server requires the certificate object be created first, take the ID, then upload. I has assumed that I could just specify an unused ID to create the object at the same time.