Specifically they should both add the subject CN to the set of subjectAltNames. Also add a small test script to verify that signing works using the command-line tool.