Not before 5.6 (where CN_match is actually deprecated in favour of peer_name)