
   that the client's certificate is signed by one of the trusted
   certificate authorities. If <code class="literal">clientcert=verify-full</code>
   is specified, the server will not only verify the certificate
   chain, but it will also check whether the username or its mapping
   matches the <code class="literal">cn</code> (Common Name) of the provided certificate.
   Note that certificate chain validation is always ensured when the
   <code class="literal">cert</code> authentication method is used
   