Put CN matching above the final recursive option merge

src/Composer/Util/RemoteFilesystem.php

@@ -338,6 +338,11 @@ class RemoteFilesystem
             $headers[] = 'Accept-Encoding: gzip';
         }
 
+        // Setup remaining TLS options - the matching may need monitoring, esp. www vs none in CN
+        $host = parse_url($originUrl, PHP_URL_HOST);
+        $this->options['ssl']['CN_match'] = $host;
+        $this->options['ssl']['SNI_server_name'] = $host;
+
         $options = array_replace_recursive($this->options, $additionalOptions);
 
         if ($this->io->hasAuthentication($originUrl)) {
@@ -357,17 +362,6 @@ class RemoteFilesystem
             $options['http']['header'][] = $header;
         }
 
-        // Setup remaining TLS options - the matching may need monitoring, esp. www vs none in CN
-        $host = parse_url($originUrl, PHP_URL_HOST);
-        $this->options['ssl']['CN_match'] = $host;
-        $this->options['ssl']['SNI_server_name'] = $host;
-
-        /**
-         * Setup TLS options CN_match and SNI_server_name based on URL given
-         */
-        $parts = parse_url($originUrl);
-
-
         return $options;
     }