client: override certificate CN/SubjectAltNames - these don't matter if fingerprint matches