fixes #2151 - use DN environment variable instead of CN

nginx is unable to pass bits of the X.509 subject, only the entire DN, so
support that as a lowest common denominator.
fixes #2146 - prevent double render