further refined ssl cert test, and fixed signing of directory server certs so they can act as intermediate CAs