As it has been pointed out, CAL is locked in openmode. The certs seem to be firmware version specific, as I understand. Actually, the quick guide is given is my original post, near those hex lines. However I think the program to read certificates from user device would benefit N950 users.

As for the simple application: I'd rather wait for some hardcore experts say is that a good idea, maybe there's some unexpected consequences and whatnot. I will think about it but I don't want to release some software to easily and irreversibly brick their device. Perhaps I'll start with cert-sw extractor for the N950 guys.