mark nsCertType non-critical, fix #39