bringing back empty cert prefixes

if neither limited nor unlimited certs are allowed there will be no prefix. Not sure if this is desired - but it's the way things used to be before the refactoring