read-once certificate