[WO-507] allow both pinned and intermediate certificates