FTS-161: For certs with no vo, use first CN