changes to support certificates on disk in addition to S3