much more helpful cert explanation

[ci skip]