rip/dellis/lneva: make the cert sign the fqdn cert