certificate first implementation