X.509 cert: fallback to root if no user specified