expose more info when certificate check fails