SSL: Only accept wildcards for one level

* in CN / SubjectAlternativeName:dNS is supposed to only match one level
of the hostname, i.e. *.example.com matches foo.example.com but not
www.foo.example.com.