Fix length checks in cert_load()