update TODO, SAN mapping done
support Persona host certificates