restricting the number of ASNs to one in the certificate