default cert fallback without SNI

The protocol specification requires that clients do not use SNI when
IP addresses are used instead of domains.

closes https://github.com/mbrubeck/agate/pull/433

Co-authored-by: oooo-ps <l.trk@tuta.io>

src/certificates.rs

@@ -222,8 +222,12 @@ impl ResolvesServerCert for CertStore {
                 .map(|(_, k)| k)
                 .cloned()
         } else {
-            // This kind of resolver requires SNI.
+            // Fallback to default cert. Due to the certificate loading logic,
-            None
+            // the fallback cert is always the last one, if it is present.
+            match self.certs.last() {
+                Some((domain, key)) if domain.is_empty() => Some(key.clone()),
+                _ => None,
+            }
         }
     }
 }