use keystone cert paths