Right now the CLI is only capable of doing dNSName SAN types, so putting "DNS:test.com" will actually embed invalid SAN names (they should just be "test.com").