I understand that the value extracted here is checked later, to ensure that nothing bad comes through, but this will absolutely match illegal values such as "\x00", or other control characters.  It might be nicer to improve that.

That aside, a much better strategy is probably to extract the CN this way:

    (OpenSSL::X509::Name.parse_openssl("/CN=hostname.foo.com/O=foo inc/OU=marketing").to_a.assoc("CN") || [])[1]

That will safely parse the string into components using the OpenSSL library (or an RFC2253 compatible parse, if you prefer), then extract the CN by turning into into an "associative list" style array and extracting the CN component from that.  (That is kind of ugly, yes, but the OpenSSL wrapper doesn't provide a better accessor than this. :/ )

That should be much safer, and will apply validation to the names early in the picture.  The biggest risk should be that we might start to enforce rules that forbid names were previously allow - your example in the pull request includes a ",", for example, which technically requires some escaping to be [RFC2253 compatible](http://tools.ietf.org/html/rfc2253#section-2.4) even though we would have allowed it unescaped in the past.

Overall I think that is a win, despite the ugly code, but there is a minor risk that certificates would be rejected that customers had successfully used until now.  (In fairness, though, any other tool than Puppet, and probably parts of the Puppet and Apache/Nginx web stack most people run should have already weeded that out.)