Our integration tests are currently using openssl to extract certificate data that will be used later in the assertions. Since OpenSSL displays principal SAN as "unknown" we can't use that in the assertions.
We need to find a way to verify that the principal was properly specified in the certificate.