---
title: Certificate User Extractor node
description: Extracts a value from the certificate collected by the Certificate Collector node, and searches for it in the identity store. The goal is to match the certificate with a user in the identity store.
component: auth-node-ref
version: 7.3
page_id: auth-node-ref::self-managed/auth-node-certificate-user-extractor
canonical_url: https://docs.pingidentity.com/auth-node-ref/latest/certificate-user-extractor.html
llms_txt: https://docs.pingidentity.com/auth-node-ref/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
section_ids:
  outcomes: Outcomes
  properties: Properties
---

# Certificate User Extractor node

Extracts a value from the certificate collected by the [Certificate Collector node](auth-node-certificate-collector.html), and searches for it in the identity store. The goal is to match the certificate with a user in the identity store.

The extracted value is stored in the `username` key in the shared node state.

## Outcomes

* `Extracted`

* `Not Extracted`

Evaluation continues through the `Extracted` path if AM finds a match for the certificate in the identity store; otherwise, evaluation continues on the `Not Extracted` path.

## Properties

| Property                                            | Usage                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| --------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Certificate Field Used to Access User Profile       | Specifies the field in the certificate that AM uses to search for the user in the identity store. Possible values are:- `Subject DN`

- `Subject CN`

- `Subject UID`

- `Email Address`

- `Other`

- `None`If you select `Other`, provide an attribute name in the Other Certificate Field Used to Access User Profile property.Select `None` if you want to specify an alternate way of looking up the user profile in the SubjectAltNameExt Value Type to Access User Profile property.Default: `Subject CN` |
| Other Certificate Field Used to Access User Profile | Specifies a custom certificate field to use as the base of the user search.                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| SubjectAltNameExt Value Type to Access User Profile | Specifies how to look up the user profile:- `None`

  AM uses the value specified in the Certificate Field Used to Access User Profile or the Other Certificate Field Used to Access User Profile properties when looking up the user profile.

- `RFC822Name`

  AM looks up the user profile using the value of the `RFC822Name` field.

- `UPN`

  AM looks up the user profile as the User Principal Name attribute used in Active Directory.Default: `None`                                                 |