regression fix
Don't (always) ignore certifacte CN mismatch

Ignore the CN check only when connecting to a server
using an IP address rather than a hostname.