addition to properly check for upstream certs