Use crhold() instead of crdup() since we aren't modifying the cred but
just need to ensure it remains immutable.