ipajoin is not called always and therefore we can no depend on the subject
base gathered from the certificate output of the join call.