only use cert if user has the matching private key (not any key in this location)