A certificate builds successfully to a trusted root but names only payments.example. What…

A certificate builds successfully to a trusted root but names only payments.example. What should a client requesting login.example do?

1. Accept it because chain validation already authenticated every hostname.
2. Reject it because the trusted chain and requested service identity are separate checks.
3. Accept it only when both names resolve to the same IP address.
4. Retry with certificate verification disabled.