or just server cert + intermediary