only look for host cert if BID_VERIFY_FLAG_RP is set