use cert commonNames for endpoints to work around InvalidCertificateException
missed some sqs and emr hosts, fix a bogus cn-north and sa-east-1 replacement