store a server's certfp on handshake