make cn field a valid single hostname, and use wildcard in SANs field.

[afdy]

fix: name and wildcard in the cn field doesn't validate for many TLS clients.

This resolves an issue with TLS validation from local clients by changing the cn name format so that clients like wget, and python requests accept it, while hopefully maintaining the same behaviour.

old:

        Subject: O=Dummy Certificate, CN=*.localhost/CN=localhost
            X509v3 Subject Alternative Name:
                DNS:*.localhost/CN=localhost

new:

        Subject: O=Dummy Certificate, CN=localhost
            X509v3 Subject Alternative Name:
                DNS:localhost, DNS:*.localhost

fixes #2891