@april also, check the ssl cert chain for signed.bad.horse