Move certificate name checking to mainline, default enabled