add a little todo list. try to replace vhost with sane clientcert