(doc) Improve description of certname setting

This commit mentions our recommendations for certname values, as well as the one
reserved certname of `ca`. It also adds some context about what the certname is
used for.