make certPath optional