TLS hostname check screwed up?