support digests as algorithmIdentifier, unbreaks certificate checking