explicitly set certname