change free cert postfix to be a prefix (this is required for how openvpn does common name matching)