I'm poking at our certificates issued extract statistics and it look slike for host certs we are not assigning any OU=<domain>. This makes it really hard to gather stats. We should fix that *before* we issue any more service certificates (this applies to host certs too, but I think we've already decided to bail on host certificates as a policy, right?) --Ivan