title: DOD Common Access Card (CAC) Authentication
body: <p>I have figured out all the necessary steps to get DOD CAC card based client certificate authentication working in Apache, but am now struggling to pull a good GUID for the user from the certificate I am receiving.  Is there a GUID available on the certificate that will not change when the CAC card is renewed?  I was thinking of using the SSL_CLIENT_S_DN which would look something like:</p>
  
  <p>/C=US/O=U.S. Government/OU=DoD/OU=PKI/OU=CONTRACTOR/CN=LAST_NAME.FIRST_NAME.MIDDLE_NAME.0123456789</p>
  
  <p>but I have heard that the number on the end changes when the CAC card is renewed.  Is this true?  Is there a better piece of information to use for a GUID?  I'd also like to get the users email address, but I don’t see it available in the information I am receiving from the certificate.  Is the email adress available in some custom extension that I am not seeing?</p>
  
  <p>Thanks!</p>