Do not check CN when checking SAN failed

This is to make it compliant with RFC 6125:

https://tools.ietf.org/html/rfc6125#section-6.4.4

Author: Matus Honek <mhonek@redhat.com>

diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c

index 92c708be0..46b48a3fb 100644

--- a/libraries/libldap/tls_o.c

+++ b/libraries/libldap/tls_o.c

@@ -675,11 +675,16 @@ tlso_session_chkhost( LDAP *ld, tls_session *sess, const char *name_in )

 			GENERAL_NAMES_free(alt);

 			if (i < n) {	/* Found a match */

 				ret = LDAP_SUCCESS;

+			} else {	/* None matched */

+				Debug( LDAP_DEBUG_ANY, "TLS: hostname (%s) does not match any "

+					"SAN in certificate.\n", 

+					name, NULL, NULL );

+				ret = LDAP_CONNECT_ERROR;

 			}

 		}

 	}

-	if (ret != LDAP_SUCCESS) {

+	if (ret == LDAP_LOCAL_ERROR) {

 		X509_NAME *xn;

 		X509_NAME_ENTRY *ne;

 		ASN1_OBJECT *obj;