try to validate against ca.crt