This was the command I used to generate the CSRs
openssl req -new -sha256 -key subsystem.key -subj "/CN=CA Subsystem /O=IPA.****.NET" -out subsystem.csr
But I guess that results in the extra space. So perhaps it should be
openssl req -new -sha256 -key subsystem.key -subj "/CN=CA Subsystem,/O=IPA.***.NET" -out subsystem.csr (?)
Apologies for all the questions that might seem pretty basic. Just trying to get this figured out.