we must check host name if cert is signed by CA