make cert loading thread safe