$ 0 0 I've removed the setting. I thought it was required if I wanted to add SAN names to CSRs that do not have them in the CSR encoded data.