perform sanity checks on server certificate type as soon as it is received instead...