There is an additional "special" bucket for certs that is not visible and has to have availability to be able to use them. You are fortunate that you found an agent not smart enough to know that and override it for you.