Author here. This is a long but, but here's the gist:

- sha256 is required for Chrome 42+ (mid April 2015) not to show warnings.

- 2048 bit RSA is the new OpenSSL default and is required for EV certificates.

- The 'subject' (the thing being attested to by the CA) you actually get in your certificate may have a lot more detail than the subject line in your CSR.

- If you're using EV, and have at least www and non-www, the CN will never be used - your CA will put all the server names inside the SAN fields. Anything else won't work with current browsers.