one roundtrip works for openssl x509