[from v1] cn isn't unique, so restrict to relevant objects
[from v1] cn isn't unique, so restrict to relevant objects

bytemine/univention-openvpn,bytemine/univention-openvpn,bytemine/univention-openvpn,bytemine/univention-openvpn