The TLS specs define how the handshake between client and server must be performed when the client wants to use a certificate to authenticate itself. There is a lot of documentation onlin that assumes that the username is put in the CN field of the x.509 certificate, but no one of the documents I found gave a reference to the specs that mandate putting the username into the CN.

Is putting the username in the CN mandated by some RFC or standard? If yes, could you please point me to that document?

  • 2
    I believe, you will find some information about X.509 certificates in tools.ietf.org/html/rfc5280 and TLS in tools.ietf.org/html/rfc5246, otherwise the question is too broad.
    – Crypt32
    Jun 11, 2018 at 15:41
  • 1
    In the RFC linked by Crypt32, it explains it in one line: "common name (e.g., "Susan Housley")"
    – schroeder
    Jun 11, 2018 at 16:03

2 Answers 2


As I understand it, validation of the client side certificate is implementation specific. Generally, it boils down to asserting that the client certificate is in a trusted PKI from the server's point of view. It may decide extra validation schemes as defined by the certificate policy.


RFC 2818 (HTTPS), after a full page on client checking server identity, has only one paragraph on server checking client identity:

Typically, the server has no external knowledge of what the client's identity ought to be and so checks (other than that the client has a certificate chain rooted in an appropriate CA) are not possible. If a server has such knowledge (typically from some source external to HTTP or TLS) it SHOULD check the identity as described above.

RFC 6125, which updates checking of TLS server identity in extensive detail for several protocols not including HTTPS, doesn't even consider checking client identity:

The following topics are out of scope for this specification:

o Client or end-user identities. ...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .