tls: allow wildcards in common name

see #4592
buffer: zero-length buffers shouldn't be slab-backed