oops, certificate defined without thumbprint