make X509_CERT_AUX opaque