initial certificate verification: `Ok