refine crypt cert handling