fix up for new certificate schema