proper crr.pem check