cert filename workaround: truncate to last 64 chars to avoid OpenSSL error on CN too long
(better workaround probably needed)