The only solution I could get was to add a clone exception for userCertificate into the clone exceptions. note: This cannot be done through the DRA GUI and had to be added to the clone exceptions the registry manually.