Cleaner handling of "cnid" in do_x509_check