wh_Server_CertVerify calls wolfSSL_CertManagerNew() instead of wolfSSL_CertManagerNew_Ex() which supports a heap hint for WOLFSSL_NO_MALLOC. Either wh_Server_CertVerify should support heap hints, wh_server_cert.c should include a check for WOLFSSL_NO_MALLOC in it's guards, or another compile time check should throw an error that WOLFSSL_NO_MALLOC and WOLFHSM_CFG_CERTIFICATE_MANAGER are mutually exclusive.