don't leak cert on errors, return null on zpp failure