clean up and simplify error responses and test code
minor: fix identity test for storing certs

we compare the cert that expires last to the one we just saved. So we need to make sure the one we saved is the one that expires last.