only retaining key and cert