Talking in person, it's not the CN, but is is validated data against the CN using the authorization system.