The Common Name (CN) for the issued certificate, e.g. jenkins.example.com.

The value must be permitted by the PKI role's allowed_domains setting. When allow_bare_domains is enabled on the role, the bare domain may be used; when allow_subdomains is enabled, subdomains are allowed.