Fix cert fallback logic