I'm not aware of a way to change this default since it seems to be hard coded. Private Browsing mode will prevent storing a permanent exception.

Do you regularly come across websites with a certificate issue that require you to add an exception?

This can happen if there are issues with missing intermediate certificates that aren't send by the server.

Unfortunately yes, at work they use invalid wildcard certs everywhere. There used to be a plugin that would override this but i can't find it now. Thanks for your help.