The hostname used to resolve the IP for the proxy and metadata service should be matched against the certificate CN.