tls: Re-enable checking of CN-ID in server identity verification

[RFC 6125](http://tools.ietf.org/html/rfc6125#section-6.4.4) explicitly states that a client "MUST NOT seek a match
for a reference identifier of CN-ID if the presented identifiers
include a DNS-ID, SRV-ID, URI-ID, or any application-specific
identifier types supported by the client", but it MAY do so if
none of the mentioned identifier types (but others) are present.

As certificates with unsupported identifiers in altnames (e. g. `email:`) are not uncommon, we should be more liberal by resorting to the (deprecated) CN-ID based verification in these cases.