var caDir string
		if opts != nil {
			caDir = opts.CADir
		}
		conf.RootCAs, err = certs.GetRootCAs(env.Get(EnvKESServerCA, caDir))
		if err != nil {
			return nil, err
		}

		client := kes.NewClientWithConfig("", conf)
		client.Endpoints = endpoints

		// Keep the default key in the KES cache to prevent availability issues
		// when MinIO restarts
		go func() {
			timer := time.NewTicker(10 * time.Second)