public url of a ssh tunnel should have certificate