node does not have to be keystone: get certificate info from keystone instance
(requires fix in keystone)