done with cert_scope