use key rather than cert