(#2848) Only mark subjectAltName critical if subject is empty.
From X509v3, the subjectAltName extension should only be marked critical if
the subject DN is empty:
"If the subject field contains an empty sequence, then the issuing CA MUST
include a subjectAltName extension that is marked as critical. When including
the subjectAltName extension in a certificate that has a non-empty subject
distinguished name, conforming CAs SHOULD mark the subjectAltName extension
as non-critical."
This applies that rule, by always marking the subjectAltName as
non-critical, because we never have an empty name in our system.
Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>