CA is currently not conforming to RFC5280 in regards to the email address as part of the identity.

Here is an excerpt from RFC5280 under "4.1.2.6. Subject":
"
Legacy implementations exist where an electronic mail address is
embedded in the subject distinguished name as an emailAddress
attribute [RFC2985]. The attribute value for emailAddress is of type
IA5String to permit inclusion of the character '@', which is not part
of the PrintableString character set. emailAddress attribute values
are not case-sensitive (e.g., "subscriber@example.com" is the same as
"SUBSCRIBER@EXAMPLE.COM").

Conforming implementations generating new certificates with
electronic mail addresses MUST use the rfc822Name in the subject
alternative name extension (Section 4.2.1.6) to describe such
identities. Simultaneous inclusion of the emailAddress attribute in
the subject distinguished name to support legacy implementations is
deprecated but permitted.
"

The CA currently allows email attribute to be in the subject DN without the subjectAltName extension. It should at the minimum put it in the subjectAltName extension even if it allows the email attribute in the subjectDN.

Note: user profiles (e.g. the one used for administrators) currently by default inserts the "E" attribute in the DN without subjectAltName extension.