- per Ivan: add "shortcut" param 'client_certification_id' (can be