Certificate-path verification