some wildcard NSECx fixes