No certificate is still accepted, but if one is provided it must be valid. Only run validation if the certificate has changed to avoid making existing records invalid.