load server key/cert separately