Add ability to confirm adding new CNs

[ibuildthecloud]

Also reject bad CNs that will prevent the secret from being saved.