fix TLSA records with multiple cert locations