use single mutex for all instances
clean idp_cert