may I ask why an hour when you are not expecting password attempts with anything other than a cert, why not 600 hours.
Once or twice I have had keyboard issues and have locked myself out (there is a "password" on the cert). I consider one hour enough punishment for myself. . If they continue to try to get in they get blocked all over again.
. If they continue to try to get in they get blocked all over again.