[nightpool]

    No part of the Subject DN or SAN is checked.

Is this true of XMPP? I thought it enforced that the SAN matched the XMPP identifier in question