second commit, add cert_decrypt tool