Research TLS certificate profiles and flags #1316

I would say this is fine for now, but I want to eventually do a deep-dive into this again. I would generally recommend to follow upstream recommendations as close as possible, but this requires more research on my end.

Originally posted by @Techassi in #1315 (comment)