filter out 'tunnel' (OSX)
allow specifying additional IP/hostnames for subjAltName