Improve master documentation + more verbose exception when CN does not match host