implement RFC6125 correctly:

 - if there is a subjectAlternativeName, use that instead of CN
 - wildcard _must_ be leftmost label
 - only a single wildcard
 - wildcard doesn't match "":
 - *.foobar.com should match foo.foobar.com and www.foobar.com, but not
foobar.com and not foo.foo.foobar.com