handle endpoints without a certificate