allow key agreement for SSL/TLS certificates