After a little more thought, it seems obvious to me now what the problem is. :-)

The shocking thing is that the certificate name matching algorithm has been standardised for over 15 years and yet those who wrote the cert generation code weren't aware of how browsers implement it.