UPD: also pin the certificate's issuer DN