As is common for Fabric, the cryptogen utility (1.4.3) has various bugs as of this writing:

1. The most important bug is that the admincerts folder is empty. see https://jira.hyperledger.org/browse/FAB-16933
2. The next bug (FAB-16936) is that if you are enabling Node OUs, the OU for the orderer’s admin has OU=client instead of OU=admin. Example:
   Subject: C=US, ST=California, L=San Francisco, OU=client, CN=Admin@foo.com
   For comparison, The peers admin have OU=admin set correctly:
   Subject: C=US, ST=California, L=San Francisco, OU=admin, CN=Admin@bar.com