update documentation, require end-entity certificate first