s4:kerberos Add support for user principal names in certificates