check the EE if its a proxy certificate and fail up front