put SAN ahead of CN, since CN is deprecated