--- a/core/certmanager.lua	Mon Jan 17 14:18:27 2022 +0000
+++ b/core/certmanager.lua	Tue Jan 18 08:04:16 2022 +0100
@@ -350,11 +350,11 @@
 		-- We can't read the password interactively when daemonized
 		password = function() log("error", "Encrypted certificate for %s requires 'ssl' 'password' to be set in config", host); end;
 	});
-	cfg:apply(global_ssl_config);
 	local preset = configmanager.get("*", "tls_preset") or "intermediate";
 	if preset ~= "legacy" then
 		cfg:apply(mozilla_ssl_configs[preset]);
 	end
+	cfg:apply(global_ssl_config);
 
 	for i = select('#', ...), 1, -1 do
 		cfg:apply(select(i, ...));