@teotwaki uuhm. uhm. I mean... technically (as in X.509 words on imaginary paper) you can even issue one without a CN, not sure if there's any implementation who would find that funny, but implying that there's any structure to what's in a CN? That sounds like someone who only ever suffered a single vendor's implementation and idea how to do things. lel. There is an abundance of other details of that spec one might want to argue over, this isn't one of them.