the pki certificates should be checked for just one of the errors of all three