better error message when server's cert doesn't match hostname