public function addCertificate($roleName, RemoteDesktopCertificate $certificate)
    {
        $namespaceUri = $this->dom->lookupNamespaceUri($this->dom->namespaceURI);
        $xpath = new \DOMXpath($this->dom);
        $xpath->registerNamespace('sc', $namespaceUri);

        $xpathExpression = '//sc:Role[@name="' . $roleName . '"]//sc:Certificates';
        $certificateList = $xpath->evaluate($xpathExpression);

        if ($certificateList->length == 1) {
            $certificatesNode = $certificateList->item(0);
            $certificateNodeToDelete = null;
            foreach ($certificatesNode->childNodes as $certificateNode) {
                if (!$certificateNode instanceof \DOMElement) {
                    continue;
                }

                if ('Microsoft.WindowsAzure.Plugins.RemoteAccess.PasswordEncryption' == $certificateNode->getAttribute('name')) {
                    $certificateNodeToDelete = $certificateNode;
                }
            }
            if (!is_null($certificateNodeToDelete)) {
                $certificatesNode->removeChild($certificateNodeToDelete);
            }
        } else {
            $certificatesNode = $this->dom->createElementNS($namespaceUri, 'Certificates');

            $roleNodeList = $xpath->evaluate('//sc:Role[@name="' . $roleName . '"]');

            if ($roleNodeList->length == 0) {
                throw new \RuntimeException("No Role found with name '" . $roleName . "'.");
            }

            $roleNode = $roleNodeList->item(0);
            $roleNode->appendChild($certificatesNode);
        }

        $certificateNode = $this->dom->createElementNS($namespaceUri, 'Certificate');
        $certificateNode->setAttribute('name', 'Microsoft.WindowsAzure.Plugins.RemoteAccess.PasswordEncryption');
        $certificateNode->setAttribute('thumbprint', $certificate->getThumbprint());
        $certificateNode->setAttribute('thumbprintAlgorithm', 'sha1');

        $certificatesNode->appendChild($certificateNode);

        $this->save();
    }