certificates don't need to be executable