make server cert match ca