add reasonable error for missing certs

Signed-off-by: Ken Barber <ken@bob.sh>