def _check_key_cert(self, cs_configs: List[pathlib.Path]):
        not_ready = [*cs_configs]

        for _ in range(5):
            logger.info(
                "Checking if all control servers have reloaded the key and certificate..."
            )
            for cs_config in not_ready:
                conn = client.HTTPConnection(self._http_endpoint(cs_config))
                conn.request("GET", "/signer")
                resp = conn.getresponse()
                if resp.status != 200:
                    logger.info("Unexpected response: %d %s", resp.status,
                                resp.reason)
                    continue

                isd_as = scion_addr.ISD_AS(cs_config.stem[2:-2])
                as_dir = self._to_as_dir(isd_as)
                chain_name = "ISD%s-AS%s.pem" % (isd_as.isd_str(),
                                                 isd_as.as_file_fmt())

                pld = json.loads(resp.read().decode("utf-8"))
                if pld["subject_key_id"] != self._extract_skid(
                        as_dir / "crypto/as" / chain_name):
                    continue
                logger.info(
                    "Control server successfully loaded new key and certificate: %s"
                    % self._rel(cs_config))
                not_ready.remove(cs_config)
            if not not_ready:
                break
            time.sleep(3)
        else:
            logger.error(
                "Control servers without reloaded key and certificate: %s" %
                [cs_config.name for cs_config in not_ready])
            sys.exit(1)