soontm: add CertFP/SASL EXTERNAL support
soontm: add pfx option