Check for bad DN qualifiers on signer certificates (#2716).