Allow wildcard certificate in service certificates  and better CN for CA certificate