refine certificate match