to use crt login, a string which resembles parts of the crt cn and dn needs to exist in an system_user record. The string is combined from SSL_CLIENT_S_DN and SSL_CLIENT_I_DN: SSL_CLIENT_S_DN + "//" + SSL_CLIENT_I_DN