allow specifying nsCertType in config