- check for CN wrt SNI / no SNI
- fix different responses for CACert