anchor.diff:  %%           of names we expect.
   %% Returns : true | false
   %%--------------------------------------------------------------------
  -is_valid_ssl_certname(ValidNames, Subject, Reject) when is_list(ValidNames), Reject == true; Reject == false ->
  -    {ok, AltName} = get_ssl_socket_altname(Subject),
  -    Matches = util:casegrep(AltName, ValidNames),
  +is_valid_ssl_certname(ValidNames, Subject, AltNames, Reject) when is_list(ValidNames),
  +								  is_record(Subject, ssl_conn_subject),
  +								  is_list(AltNames) ->
  +    CommonName = Subject#ssl_conn_subject.commonName,
  +    {ok, Matches, MatchingName} = get_matching_altname(ValidNames, CommonName, AltNames),
       case {Matches, Reject} of
   	{true, _Reject} ->
   	    logger:log(debug, "Transport layer: Verified that subjectAltName/CN (~p) is in list of "
  -		       "valid names for this certificate (~p)", [AltName, ValidNames]),
  +		       "valid names for this certificate (~p)", [MatchingName, ValidNames]),
   	    true;
   	{false, true} ->
  -	    logger:log(normal, "Transport layer: Rejecting SSL socket since subjectAltName/CN (~p) "
  -		       "is not in list of valid names for this certificate (~p)", [AltName, ValidNames]),
  +	    logger:log(normal, "Transport layer: Rejecting SSL certificate with commonName ~p and "
  +		       "subjectAltName ~p since it does not match list of valid names for this connection : ~p",
  +		       [CommonName, AltNames, ValidNames]),
   	    false;
   	{false, false} ->
  -	    logger:log(debug, "Transport layer: Warning: subjectAltName/CN (~p) is not in list of "
  -		       "valid names for this certificate (~p)",
  -		       [AltName, ValidNames]),
  +	    logger:log(debug, "Transport layer: Warning: SSL certificate with commonName ~p and "
  +		       "subjectAltName ~p does not match list of valid names for this connection : ~p",
  +		       [CommonName, AltNames, ValidNames]),
   	    true
       end;
  -is_valid_ssl_certname(undefined, Subject, true) ->
  -    {ok, AltName} = get_ssl_socket_altname(Subject),
  -    logger:log(debug, "Transport layer: Rejecting connection with subjectAltName/CN ~p since list of valid "
  -	       "names is undefined", [AltName]),
  +is_valid_ssl_certname(undefined, Subject, AltNames, true) when is_record(Subject, ssl_conn_subject),
  +							       is_list(AltNames) ->
  +    logger:log(debug, "Transport layer: Rejecting connection with SSL commonName ~p and subjectAltName ~p "
  +	       "since list of valid names is undefined", [Subject#ssl_conn_subject.commonName, AltNames]),
       false;
  -is_valid_ssl_certname(undefined, Subject, false) ->
  -    {ok, AltName} = get_ssl_socket_altname(Subject),
  -    logger:log(debug, "Transport layer: Warning: subjectAltName/CN ~p not matched against list of"
  -	       "valid names, since list is undefined", [AltName]),
  +is_valid_ssl_certname(undefined, Subject, AltNames, false) when is_record(Subject, ssl_conn_subject),
  +								is_list(AltNames) ->
  +    logger:log(debug, "Transport layer: Warning: Not matching commonName ~p and subjectAltName ~p against "
  +	       "a list of valid names, since list is undefined",
  +	       [Subject#ssl_conn_subject.commonName, AltNames]),
       true.
   
  -get_ssl_socket_altname({rndSequence, AttrList}) ->
  -    %% XXX commonName is not always set to the FQDN. Find a better (more correct)
  -    %% way to get the subjectAltName
  -    {ok, {printableString, CN}} = ssl_subject_get(commonName, AttrList),
  -    {ok, CN}.
  -
  -get_ssl_identification({rndSequence, AttrList}) ->
  -    {ok, C} = ssl_subject_get(countryName, AttrList),
  -    {ok, {printableString, O}} = ssl_subject_get(organizationName, AttrList),
  -    {ok, {printableString, CN}} = ssl_subject_get(commonName, AttrList),
  -    {ok, lists:append(["C=", C, ", O=", O, ", CN=", CN])}.
  -
  -%% XXX 'AttributeTypeAndValue' is really a record defined in ssl_pkix.hrl, but I
  -%% haven't found a way to include that file.
  -ssl_subject_get(Key, [[{'AttributeTypeAndValue', Key, Value}] | _T]) ->
  -    {ok, Value};
  -ssl_subject_get(Key, [_H | T]) ->
  -    ssl_subject_get(Key, T);
  -ssl_subject_get(_Key, []) ->
  -    none.
  +%% part of is_valid_ssl_certname/4
  +%% Returns : {ok, true, MatchingName} |
  +%%           {ok, false, undefined}
  +get_matching_altname(ValidNames, CommonName, [H | T]) when is_list(ValidNames), is_list(CommonName) ->
  +    case util:casegrep(H, ValidNames) of
  +	true ->
  +	    {ok, true, H};
  +	false ->
  +	    get_matching_altname(ValidNames, CommonName, T)
  +    end;
  +get_matching_altname(ValidNames, CommonName, []) when is_list(ValidNames), is_list(CommonName) ->
  +    %% no matching subjectAltName, check commonName
  +    case util:casegrep(CommonName, ValidNames) of
  +	true ->
  +	    {ok, true, CommonName};
  +	false ->
  +	    {ok, false, undefined}
  +    end.
   
   %%--------------------------------------------------------------------
   %% Function: get_settings(Proto)
  
positive.code: 			       "considering SSL connection to ~s:~p invalid : ~p", [IP, Port, Reason]),
  		    false
  	    end
      end.
  
  %%--------------------------------------------------------------------
  %% Function: is_valid_ssl_certname(ValidNames, Dir, Reject)
  %%           ValidNames = list() of string(), the hostname(s) we want
  %%                        to make sure the subjectAltName matches.
  %%           Subject    = term(), SSL subject data
  %%           Reject     = true | false, reject if name does not match
  %%                        or just log?
  %% Descrip.: Check if a socket is 'acceptable'. For SSL, this means
  
negative.code: 			in -> true;
  			out ->
  			    {ok, Reject} = yxa_config:get_env(ssl_check_subject_altname),
  			    is_valid_ssl_certname(Names, Subject, AltNames, Reject)
  		    end
  	    end;
  	{error, Reason} ->
  	    {ok, RequireClientCert} = yxa_config:get_env(ssl_require_client_has_cert),
  	    case {Dir, RequireClientCert} of
  