make sha-256 cert an optional requirement to the intermediate level
fix target level verification check