extract 'sub' from certificates