add support for cert passphrase