blacklist certificates

r? @ab