Add the StartCom Free SSL Certificate Authority certificate (as used by jabber.org), and change the order of certificate validation checks so that CA mismatch is detected before name checking. There's still lots of room for improvement in certificate validation because the first Accept or Reject overrides any subsequent checks.