sni improvements

This pull request changes the certdir setting to be treated as a path relative to the chroot. This way, it is possible for the same path to sanely work for both the default cert files loaded before chrooting as well as SNI cert files loaded after chrooting.

Additionally, make SNI failures fallback to the default cert rather than erroring out.