The bad cert handling should be same for the app was well as the wx.

We should either throw or invoke a callback.