This option can have one
       of two values. If you specify <code class="literal">clientname=CN</code>, which
       is the default, the username is matched against the certificate's
       <code class="literal">Common Name (CN)</code>. If instead you specify
       <code class="literal">clientname=DN</code> the username is matched against the
       entire <code class="literal">Distinguished Name (DN)</code> of the certificate.
       This option is probably best used in conjunction with a username map.
