Note about SAN and subject values

Author: tashian

step-ca/templates.mdx

@@ -2,6 +2,7 @@
 title: Configuring `step-ca` Templates
 html_title: Configuring open source step-ca Templates
 description: Learn how to configure step-ca Templates
+updated_at: March 24, 2024
 ---
 
 People use private CAs for all sorts of things, in many different contexts:
@@ -219,14 +220,18 @@ See [the complete list of fields supported in `step-ca` templates](https://githu
 Here are some constants available in X.509 certificate templates:
 
 - **.Subject**:
-  This is the subject that was passed in to `step certificate` or `step ca certificate`. Specifically,
-  `.Subject.CommonName` contains the Common Name for the certificate.
+  The subject that was passed in to `step certificate` or `step ca certificate`. Specifically,
+  `.Subject.CommonName` contains the Common Name for the certificate. By default, a passed-in subject
+  value must match a value from a trusted source in order to be added to the certificate. The
+  client is only a trusted source if they are an admin using the JWK provisioner.
 
 - **.SANs**:
   Subject Alternative Names.
   This is a list of maps containing SANs for the certificate.
   Unless SANs are specified (using the `--san` flag, for example),
-  the `.Subject.CommonName` is the default SAN.
+  the `.Subject.CommonName` is the default SAN. By default, a passed-in subject
+  value must match a value from a trusted source in order to be added to the certificate. The
+  client is only a trusted source if they are an admin using the JWK provisioner.
 
 - **.Token**:
   If a signed token was used to obtain the certificate 
@@ -750,8 +755,8 @@ If you need to pass more than one value,
 you can use `--set` multiple times or use a JSON file with multiple properties.
 
 It's worth mentioning the while we used `"dnsNames"` instead of `"sans"` in the example above, both can
-be used. `"dnsNames"` is an array of strings (or just one string if only one is
-required), while `"sans"` is an array of objects like:
+be used. `"dnsNames"` is a list of strings (or just one string if only one is
+required), while `"sans"` is an list of maps:
 
 ```json
 [
@@ -762,7 +767,7 @@ required), while `"sans"` is an array of objects like:
 ]
 ```
 
-The array `.SANs` is generated by the provisioner,
+The list `.SANs` is generated by the provisioner,
 containing the values of the trusted names.
 
 Besides `"dnsNames"`, you can also use `"emailAddresses"`, `"ipAddresses"`, and