See change from go 1.15: https://golang.org/doc/go1.15#commonname
See cloudfoundry/cf-deployment#903 Capi is doing the same and need changes to happen in cf-d before they can bump to go 1.15
If this causes operators to regenerate certs, this could be interesting/a breaking change in cf-d etc. (unless credhub/BOSH can do things automatically)