diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 8984161..0300495 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -1908,10 +1908,10 @@ display_dn() {
 # generate default SAN from req/X509, passed by full pathname
 default_server_san() {
 	path="$1"
-	cn=$(
+	cn="$(
 		easyrsa_openssl req -in "$path" -noout -subject -nameopt sep_multiline |
 		awk -F'=' '/^  *CN=/{print $2}'
-		)
+		)"
 
 	if echo "$cn" | grep -E -q '^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$'; then
 		print "subjectAltName = IP:$cn"