refactored certificate resolver