EWS certificate should be signed by SDM only