implement default certificate behaviour as specified in CertificateStoreWithDefault documentation, including tests