self-signed cert doesn't quite work