Hi Roumen, did you read my last email? Is this possible? "So can you somehow patch opensssh source code to read from X509v3 certificate only CN or principal name or something we want and pair with username we provide when we try to ssh. And if this not mach, we abort logon" Regards, Goran.