cleanup
package internalize our aux certificate internals
DO NO SWALLOW THE ORIGINAL EXCEPTION (+ the obligratory cleanup)