Leading * label in server certificate matches multiple labels