pull correct DN from certificate whether it is a raw certificate or proxy