no longer allow bad certs