Fix CN matching to use correct host (should almost eliminate TLS retries where wildcard CNs are used)