only check cert when needed