This is required by RFC 5280.

Fixes #16686

Change-Id: I291c68dd97410a4f7ae7c4e524b91a2493ac50a9
Reviewed-on: https://go-review.googlesource.com/34245Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>