read certs relative to chroot
if we can't find a cert for sni, fallback to default