client changes to support verifying server certificate