Use 'bos.oscar.aol.com' as the common name for the initial BOS connection. The redirect from the login server to first BOS server doesn't include the magic TLV with a name to use for comparison; I missed this because I cached all those certificates before I fixed the code for the other SNAC family servers.