Explain ATS's interesting default SSL cert selection criteria