Keys are looked up in that order, unless otherwise specified.
<client> is the client's virtual address.
-<servername> must be a valid DNS hostname and not look like an address.
+<servername> must be a valid lowercase DNS hostname and not look like
+an address, or be COMMON, DEFAULT or SERVER.
Things not in a section are an error.