core.certmanager: Apply TLS preset before global settings (thanks Menel) Allows overriding settings via the global 'ssl' settings as before. This order was probably accidental. That said, 'ssl' is a giant footgun we will want to discourage use of.

exclude = {
	"^%./spec/";
}