prevent zero-byte certs, add retries, fixes #271