certificate no entries condition works