I can observe that `subject.to_s` does not correctly encode the commas.

However, Apache provides certs in the form `O=Foo\, Inc,CN=client2a.example.org`.  I'll test that, too.