Full review (do not merge)

403 is appropriate, but I think the message should be changed, as we can only get this exception if there's something wrong with the cert, for example missing 'CN' field.