Release/pebbles/master ssl cn

One finding from debugging the L3 with dirk. The other option is to backport the full solution we have in Havana, if that's preferred.