SNI fix

Without this fix you always get the first cert attached to an IP and not necessarily the cert attached to the domain you're trying to scan.

Could be made modular in order to simulate a client which doesn't support SNI...