Domain ordering not respected, unexpected certificate subject

[jvanasco]

@jsha

Long-term, we and the rest of the industry plan to put nothing in the Subject CN. The Subject CN is not used for validation in any modern systems so it's clearer to leave it empty. I'd be curious to hear what your use case is for needing a specific Subject CN. And in general it would be good to plan for Subject CNs to go away in the not-too-distant future (no timeline announced yet).

Worth adding: The Subject CN has been deprecated for verification since 2000 by RFC and the CA/B Forum supports that. Within the industry, the existing usage of Subject CN is considered to be legacy support only, and I think the only non-deprecated usage is for UX. Several browsers and projects completely ignore the field.