failover for certs and keys