diff --git a/sandbox/keys.zip b/sandbox/keys.zip
new file mode 100644
index 0000000000..c2eabbdb78
Binary files /dev/null and b/sandbox/keys.zip differ
diff --git a/sandbox/unzip_keys.pl b/sandbox/unzip_keys.pl
new file mode 100755
index 0000000000..520eca8229
--- /dev/null
+++ b/sandbox/unzip_keys.pl
@@ -0,0 +1,32 @@
+#!/usr/bin/perl -w
+use strict;
+use Data::Dumper;
+use File::Slurp qw/read_file/;
+use IO::Uncompress::Unzip qw/unzip/;
+
+my $zip = read_file("keys.zip");
+my $z = IO::Uncompress::Unzip->new(\$zip, MultiStream => 0, Append => 1);
+
+my $data;
+while(!$z->eof() && (my $hdr = $z->getHeaderInfo())) {
+    print "+++ found $$hdr{Name}\n";
+    unless($hdr->{Name} =~ /\.pem$/) {
+        # wrong file, just read stream, clear buffer and try next
+        while($z->read($data) > 0) {};
+        $data = undef;
+        $z->nextStream();
+        next;
+    }
+
+    # got our pem file
+    while($z->read($data) > 0) {}
+    last;
+}
+$z->close();
+unless($data) {
+    die "no PEM file found\n";
+}
+
+open my $fh, ">:raw", "/tmp/out.zip";
+print $fh $data;
+close $fh;
diff --git a/t/api-rest/api-all-links.t b/t/api-rest/api-all-links.t
index 43fdbfa541..edbfc3f4a4 100644
--- a/t/api-rest/api-all-links.t
+++ b/t/api-rest/api-all-links.t
@@ -2,7 +2,6 @@ use warnings;
 use strict;
 
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 
@@ -10,15 +9,9 @@ my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
 my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 # OPTIONS tests
 {
diff --git a/t/api-rest/api-balanceintervals.t b/t/api-rest/api-balanceintervals.t
index a21ebff33f..3b172c9551 100644
--- a/t/api-rest/api-balanceintervals.t
+++ b/t/api-rest/api-balanceintervals.t
@@ -5,7 +5,6 @@ use threads::shared qw();
 
 #use Sipwise::Base; #causes segfault when creating threads..
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 use Time::HiRes; #prevent warning from Time::Warp
@@ -53,18 +52,10 @@ if ($is_local_env) {
 my %config = $catalyst_config->getall();
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 my $req_identifier;
 my $infinite_future;
diff --git a/t/api-rest/api-billingnetworks.t b/t/api-rest/api-billingnetworks.t
index 70ff59f776..36b023d540 100644
--- a/t/api-rest/api-billingnetworks.t
+++ b/t/api-rest/api-billingnetworks.t
@@ -1,6 +1,5 @@
 use Sipwise::Base;
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 use Storable qw();
@@ -17,18 +16,11 @@ use NGCP::Panel::Utils::BillingNetworks qw();
 my $is_local_env = 0;
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 {
     my $blocks = [{ip=>'fdfe::5a55:caff:fefa:9089',mask=>128},
diff --git a/t/api-rest/api-billingprofiles.t b/t/api-rest/api-billingprofiles.t
index 28cb5329f0..99b61829e1 100644
--- a/t/api-rest/api-billingprofiles.t
+++ b/t/api-rest/api-billingprofiles.t
@@ -1,24 +1,16 @@
 use Sipwise::Base;
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 
 my $is_local_env = 0;
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 # OPTIONS tests
 {
diff --git a/t/api-rest/api-contracts.t b/t/api-rest/api-contracts.t
index e1dbbf3aa9..b427434232 100644
--- a/t/api-rest/api-contracts.t
+++ b/t/api-rest/api-contracts.t
@@ -2,7 +2,6 @@
 
 use Sipwise::Base;
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 
@@ -11,18 +10,11 @@ use DateTime::Format::Strptime qw();
 use DateTime::Format::ISO8601 qw();
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
 
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 # OPTIONS tests
 {
diff --git a/t/api-rest/api-customercontacts.t b/t/api-rest/api-customercontacts.t
index 9082587090..7b2b5ccbc8 100644
--- a/t/api-rest/api-customercontacts.t
+++ b/t/api-rest/api-customercontacts.t
@@ -1,22 +1,14 @@
 use Sipwise::Base;
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 #goto SKIP;
 # OPTIONS tests
diff --git a/t/api-rest/api-customerfraudpreferences.t b/t/api-rest/api-customerfraudpreferences.t
index 917b40b742..f428278376 100644
--- a/t/api-rest/api-customerfraudpreferences.t
+++ b/t/api-rest/api-customerfraudpreferences.t
@@ -1,22 +1,13 @@
 #use Sipwise::Base;
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 #$ua->add_handler("request_send",  sub {
 #    my ($request, $ua, $h) = @_;
diff --git a/t/api-rest/api-customers.t b/t/api-rest/api-customers.t
index bdb40fb750..f1ae1600a7 100644
--- a/t/api-rest/api-customers.t
+++ b/t/api-rest/api-customers.t
@@ -4,7 +4,6 @@ use strict;
 use warnings;
 
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 
@@ -12,23 +11,11 @@ use DateTime qw();
 use DateTime::Format::Strptime qw();
 use DateTime::Format::ISO8601 qw();
 
-BEGIN {
-    unshift(@INC,'../../lib');
-}
-
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
-
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
 
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 # OPTIONS tests
 {
diff --git a/t/api-rest/api-events.t b/t/api-rest/api-events.t
index 3c25221d55..84dde51db8 100644
--- a/t/api-rest/api-events.t
+++ b/t/api-rest/api-events.t
@@ -1,6 +1,5 @@
 #use Sipwise::Base;
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 use Data::Dumper;
@@ -8,18 +7,11 @@ use Data::Dumper;
 my $is_local_env = 0;
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
 
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 #$ua->add_handler("request_send",  sub {
 #    my ($request, $ua, $h) = @_;
diff --git a/t/api-rest/api-journals.t b/t/api-rest/api-journals.t
index 06435c3b96..4005c4b6c4 100644
--- a/t/api-rest/api-journals.t
+++ b/t/api-rest/api-journals.t
@@ -1,6 +1,5 @@
 use Sipwise::Base;
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 use Storable qw();
@@ -39,18 +38,11 @@ if ($is_local_env) {
 my %config = $catalyst_config->getall();
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 my $t = time;
 my $default_reseller_id = 1;
diff --git a/t/api-rest/api-lnp.t b/t/api-rest/api-lnp.t
index 36e1dbbeeb..6ec661be5c 100644
--- a/t/api-rest/api-lnp.t
+++ b/t/api-rest/api-lnp.t
@@ -1,6 +1,5 @@
 use Sipwise::Base;
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 use DateTime::Format::ISO8601;
@@ -13,18 +12,11 @@ use warnings;
 my $is_local_env = 0;
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 #$ua->add_handler("request_send",  sub {
 #    my ($request, $ua, $h) = @_;
diff --git a/t/api-rest/api-method-override.t b/t/api-rest/api-method-override.t
index 6dba4cdea2..08d2d8f867 100644
--- a/t/api-rest/api-method-override.t
+++ b/t/api-rest/api-method-override.t
@@ -1,24 +1,16 @@
 use Sipwise::Base;
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 
 my $is_local_env = 0;
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 #$ua->add_handler("request_send",  sub {
 #    my ($request, $ua, $h) = @_;
diff --git a/t/api-rest/api-profilepackages.t b/t/api-rest/api-profilepackages.t
index 514504d51e..ae17667e18 100644
--- a/t/api-rest/api-profilepackages.t
+++ b/t/api-rest/api-profilepackages.t
@@ -2,7 +2,6 @@ use warnings;
 use strict;
 
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 use Storable qw();
@@ -12,18 +11,11 @@ use JSON::PP;
 use LWP::Debug;
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
 
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 # OPTIONS tests
 {
diff --git a/t/api-rest/api-resellers.t b/t/api-rest/api-resellers.t
index 9e93224927..bdd47e58e4 100644
--- a/t/api-rest/api-resellers.t
+++ b/t/api-rest/api-resellers.t
@@ -2,23 +2,15 @@ use warnings;
 use strict;
 
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 # OPTIONS tests
 {
diff --git a/t/api-rest/api-rewriterulesets.t b/t/api-rest/api-rewriterulesets.t
index 5a2e2e1555..26f335d579 100644
--- a/t/api-rest/api-rewriterulesets.t
+++ b/t/api-rest/api-rewriterulesets.t
@@ -2,23 +2,15 @@ use warnings;
 use strict;
 
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 # OPTIONS tests
 {
diff --git a/t/api-rest/api-root.t b/t/api-rest/api-root.t
index b6603da6d4..28bf6b32eb 100644
--- a/t/api-rest/api-root.t
+++ b/t/api-rest/api-root.t
@@ -2,23 +2,15 @@ use strict;
 use warnings;
 
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
 
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 # OPTIONS tests
 {
diff --git a/t/api-rest/api-rtc-full.t b/t/api-rest/api-rtc-full.t
index 884df19d6a..70538254cd 100644
--- a/t/api-rest/api-rtc-full.t
+++ b/t/api-rest/api-rtc-full.t
@@ -2,7 +2,6 @@ use warnings;
 use strict;
 
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 use URI::Escape qw();
@@ -17,7 +16,6 @@ unless ($ENV{TEST_RTC}) {
 }
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my $domain_name = $ENV{TEST_RTC_DOMAIN};
 unless ($domain_name) {
@@ -25,15 +23,9 @@ unless ($domain_name) {
 }
 
 my ($ua, $req, $res, $data);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 my ($domain_id);
 {
diff --git a/t/api-rest/api-subscribers-groups.t b/t/api-rest/api-subscribers-groups.t
index 2fc0c7d7d6..c0908fb644 100644
--- a/t/api-rest/api-subscribers-groups.t
+++ b/t/api-rest/api-subscribers-groups.t
@@ -1,24 +1,16 @@
 use Sipwise::Base;
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 
 my $is_local_env = 0;
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 #$ua->add_handler("request_send",  sub {
 #    my ($request, $ua, $h) = @_;
diff --git a/t/api-rest/api-systemcontacts.t b/t/api-rest/api-systemcontacts.t
index f00394c0cd..6de4078019 100644
--- a/t/api-rest/api-systemcontacts.t
+++ b/t/api-rest/api-systemcontacts.t
@@ -2,23 +2,15 @@ use strict;
 use warnings;
 
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 #goto SKIP;
 # OPTIONS tests
diff --git a/t/api-rest/api-topuplogs.t b/t/api-rest/api-topuplogs.t
index 61c2138aa6..f8e280bb45 100644
--- a/t/api-rest/api-topuplogs.t
+++ b/t/api-rest/api-topuplogs.t
@@ -5,7 +5,6 @@ use Scalar::Util qw(looks_like_number);
 
 #use Sipwise::Base; #causes segfault when creating threads..
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 use DateTime::Format::Strptime;
@@ -37,18 +36,11 @@ if ($is_local_env) {
 my %config = $catalyst_config->getall();
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 my $t = time;
 my $default_reseller_id = 1;
diff --git a/t/api-rest/api-valid-patch.t b/t/api-rest/api-valid-patch.t
index 8b6c16afd2..0cbe9a23a9 100644
--- a/t/api-rest/api-valid-patch.t
+++ b/t/api-rest/api-valid-patch.t
@@ -2,23 +2,15 @@ use strict;
 use warnings;
 
 use Net::Domain qw(hostfqdn);
-use LWP::UserAgent;
 use JSON qw();
 use Test::More;
 
 my $uri = $ENV{CATALYST_SERVER} || ('https://'.hostfqdn.':4443');
-my ($netloc) = ($uri =~ m!^https?://(.*)/?.*$!);
 
 my ($ua, $req, $res);
-$ua = LWP::UserAgent->new;
-
-$ua->ssl_opts(
-        verify_hostname => 0,
-        SSL_verify_mode => 0,
-    );
-my $user = $ENV{API_USER} // 'administrator';
-my $pass = $ENV{API_PASS} // 'administrator';
-$ua->credentials($netloc, "api_admin_http", $user, $pass);
+
+use Test::Collection;
+$ua = Test::Collection->new()->ua();
 
 my $body;
 
diff --git a/t/lib/Test/Collection.pm b/t/lib/Test/Collection.pm
index 899dda50a6..fc281ec1dd 100644
--- a/t/lib/Test/Collection.pm
+++ b/t/lib/Test/Collection.pm
@@ -19,6 +19,14 @@ use Data::Dumper;
 use File::Slurp qw/write_file/;
 use Storable;
 use Carp qw(cluck longmess shortmess);
+use IO::Uncompress::Unzip;
+
+has 'crt_path' => (
+    is => 'ro',
+    isa => 'Str',
+    lazy => 1,
+    default => sub {'/tmp/apicert.pem';},
+);
 
 has 'data_cache_file' => (
     is => 'ro',
@@ -252,8 +260,47 @@ sub init_ua {
         verify_hostname => 0,
         SSL_verify_mode => 0,
     );
+    $self->init_ssl_cert($ua);
     return $ua;
 }
+sub init_ssl_cert {
+    my ($self, $ua) = @_;
+    unless(-f $self->crt_path) {
+        my $res = $ua->post(
+            $self->base_uri . '/api/admincerts/',
+            Content_Type => 'application/json',
+            Content => '{}'
+        );
+        unless($res->is_success) {
+            die "failed to fetch client certificate: " . $res->status_line . "\n";
+        }
+        my $zip = $res->decoded_content;
+        my $z = IO::Uncompress::Unzip->new(\$zip, MultiStream => 0, Append => 1);
+        my $data;
+        while(!$z->eof() && (my $hdr = $z->getHeaderInfo())) {
+            unless($hdr->{Name} =~ /\.pem$/) {
+                # wrong file, just read stream, clear buffer and try next
+                while($z->read($data) > 0) {}
+                $data = undef;
+                $z->nextStream();
+                next;
+            }
+            while($z->read($data) > 0) {}
+            last;
+        }
+        $z->close();
+        unless($data) {
+            die "failed to find PEM file in client certificate zip file\n";
+        }
+        open my $fh, ">:raw", $self->crt_path or die "failed to open " . $self->crt_path . ": $!\n";
+        print $fh $data;
+        close $fh;
+    }
+    $ua->ssl_opts(
+        SSL_cert_file => $self->crt_path,
+        SSL_key_file => $self->crt_path,
+    );
+}
 sub runas {
     my $self = shift;
     my($role_in,$uri) = @_;