use helper cert by default