That should be called “the certificate dilemma”