handle more cert validation failures

fixes #2344