New rules for offline certificate