SSLO Policy Condition - Server Certificate (Issuer DN)

I think I have found the issue, it appears to be a bug in the SSLO policy UI.

If I create a rule with a match condition 'Server Certificate (Issuer DN)' and select a data group the resulting expression in the VPE is:

expr {[mcget {perflow.ssl.server_cert.issuer}] contains "/Common/TEST_DG"}

This results in a lookup failure (i.e. no match).

If I change the expression to:

expr {[class match [mcget {perflow.ssl.server_cert.issuer}] contains "/Common/TEST_DG"}

Then the expression matches and the rule executes the action.

My DG is a string with the CN=<cn-to-match> in vlaue and data fields.. perhaps this is why? Documentation on VPE variables and DG construct is a bit thin