cert validate opt-out