ssl: deny recursively defined sni_hosts