rewind stream after reading
Document alternative certificate configuration.