move masks out of CERT structure