use bogus cert password and move to config file