diff --git a/tools/virt-pki-validate.in b/tools/virt-pki-validate.in
index f77521d1d980c13e7db855dc580984f58eb0daea..207fa76c6218a90d3bafceae0748418eb31c3d72 100755
--- a/tools/virt-pki-validate.in
+++ b/tools/virt-pki-validate.in
@@ -130,7 +130,12 @@ then
     echo "as root do: chmod 644 $CA/cacert.pem"
     exit 1
 fi
-ORG=`$CERTOOL -i --infile $CA/cacert.pem | sed -n '/Issuer/ s+Issuer: CN=++p'`
+sed_get_org='/Issuer:/ {
+  s/.*Issuer:.*CN=//
+  s/,.*//
+  p
+}'
+ORG=`$CERTOOL -i --infile $CA/cacert.pem | sed -n "$sed_get_org"`
 if [ "$ORG" = "" ]
 then
     echo the CA certificate $CA/cacert.pem does not define the organization