A few more hurdles might involve expectations of SHA-1 cert signing, and TLS1.0 deprecation