On May 5, 2016, at 10:22 AM, Arran Cudbard-Bell <a.cudbardb at freeradius.org> wrote: > It *may* contain a CN, and that *may* be an NAI. Most importantly, it's under the control of the admin who's issuing the certs. So... 99% of people use the NAI in the common name. Doing anything else is crazy. Alan DeKok.