better handling of returning existing certificate