Extract a variable for "exceptions to not retry."
Refactor auth retry into its own method.
Intercept 401s or 403s for other requests.

Everywhere CertificateError is handled separately, to be precise. Just in case
the API suddenly decides you need to be authenticated I guess.