honor glob matches w/ CertDir