fix: do not use cert '-subj' with hostname to generate cert, use subjectAltName

Cause: The code was using openssl -subj /CN=$(hostname) to generate the
cert used for the server.  The argument to '-subj' has a maximum length
of 64 characters, but the hostname is longer than that.

Consequence: The role would issue an error attempting to generate the
certificate if the hostname was too long.

Fix: Do not use '-subj' with the hostname.  Certificate verification uses subjectAltName
and the role was already using this in the generated cert.  However, we have
to have something in `-subj` otherwise openssl will prompt for input, so we
just use `/O=Red Hat` as is used with the token signer.

Result: The role can generate certificates which are secure without an
error when the hostnames are too long for `-subj`.

Signed-off-by: Rich Megginson <rmeggins@redhat.com>

Author: richm

tasks/trustee_quadlet.yml

@@ -38,7 +38,7 @@
     # Trustee Server SSL
     if [ ! -f {{ __trustee_server_config_dir }}/kbs/server.key ] || [ ! -f {{ __trustee_server_config_dir }}/kbs/server.crt ]; then
       openssl req -x509 -newkey rsa:2048 -nodes -keyout {{ __trustee_server_config_dir }}/kbs/server.key \
-        -subj "/CN=$(hostname -f)/O=Red Hat" \
+        -subj "/O=Red Hat" \
         -addext "basicConstraints=CA:FALSE" \
         -addext "keyUsage=digitalSignature,keyEncipherment" \
         -addext "extendedKeyUsage=serverAuth" \