cert validation errors are allowedwith user notification, per mike hearns implementation guidance