Fixed SSL identity matching, added back CN check