use certificate to valifate message, not public key