Extended my embedded-zero-in-cert-name fix based on a comment from Scott Cantor. My previous attempt was half-baked and didn't cover the normal CN case.
