explain cert validation failure, with advice