better implementation of default certificate profile