fin on fin; actually verify server certificate