match on correct return value for cert and key