add session cert conversion to x509, and free x509 for dynamic variety