Strip email=... part from username, it would get too long and should (if anywhere) just appear as SAN, except that we don't use those in the test CA.