tls: proper dot position for matching subdomains