A couple of options for TLS configuration. Still a conflict here,

the default context is initialized before the config file is read,
so the locations are not know at context initialization.