OpenSSL provides an API where the elements of the SAN can be passed one at a time and this API works fine in preserving the comma in the URI.

The definition in Part 3 conflicts with the definition in Part 6

Part 6
6.2.2 Application Instance Certificate
Table 36 – Application Instance Certificate
subjectAltName
The alternate names for the application Instance.
Shall include a uniformResourceIdentifier which is equal to the applicationUri. The URI shall be a valid URL (see RFC 3986) or a valid URN (see RFC 8141).

It is right that we found another function in the OpenSSL API to create a certificate with a comma in the URI but we so far we have not found a way to create a signing request

Updated to used URNs instead of tags.

Added this context:

Note the URN examples do not use an existing IANA URN namespace identifier. Instead a DNS name and a date are used to ensure global uniqueness and time invariance. The date used in a URN is the date when a new URN is created and indicates that the URN was created onbehalf the owner of the domain on that date.

Agreed to changes edited in Web Meeting.