not checking certs still provides some protection against passive attacks