I am currently working on a project where nearly whole communication is done using HTTPS and ActiveMQ. Servers and clients are physically in different places, different organizations and in different domains. System components will communicate using 2-way SSL (or rather TLS w/ Mutual Authentitcation? I'm not very good at naming things yet), which gives us authentication, but we'd like to use some value from certificate to perform authorization (particularly access to queues on message broker). Because of these and other requirements, we'd like to give unique URI-like identifier to each component of the system. We have decided that it will look similarly to this: "<ORGANIZATION>.backend.processor" or "<ORGANIZATION>.device.<UUID>"..
Now, my question is: should I put this identifier into DN/CN field and put DNS names (so physical addresses) into SAN (or subjAltName) of the certificate, or rather should I put it into SAN and DNS into both SAN and DN/CN field?
According to this answer, putting aforementioned identifier into DN/CN field is secure, since our infrastructure will be homogeneous and connections from external sources will be done only by browsers, which we can easily put requirements on, this should work flawlessly. But maybe we should generate two certificates for each component and use one for presenting to connecting clients (so DNSname in both SAN and DN/CN) and the other one to authorize ourselves to components that we connect to?