fixes #1: picking which certificate to use works