use cert from connection