some work to read certificates out of the saml response