allow cert signing w/o Cert object, buffer only