Certificate-based encryption