matching a certfp counts as matching a password