bugfix on getting urns in certs