Ticket #2584 - Installation fails when CN is set in certificate subject base
    
    It is illegal to have more than one CN attribute in a certificate
    subject. The subject command line arg is actually inserting a dn
    between a leading RDN with a CN attribute and a suffix. The final
    subject must have only CN attribute therefore the subject command line
    arg must not contain CN. The patch modifies the subject validation to
    prohibit CN. It also improves the error messages to clearly indicate
    which command line parameter caused the failure and why.
    
    While fixing the above it discovered the logic used for subject
    validation with an external CA was flawed. DN objects were not being
    used when they should be (certificate subject and issuer fields are dn
    syntax). That code was also fixed so that the comparisions between
    subjects and issuers were performed with DN objects. While fixing this
    it was noted the object type relationship between IPA DN objects and
    x509 DN objects was awkward, ticket 3003 was opened to address this.