CACreateCert: allow multiple --suffix options