maybe the cert is only the one for the TLD