Docs: add warning on SNI-dependent certfile expansion needing a good default