Add the ability to use certs exclusively, so that the client doesn't
have to provide cname and password - it will use its fqdn, and then
after that, it will extract the CN from its cert.