For TLS-based EAP types such as TLS, TTLS, and PEAP, this optional parameter allows you to rewrite the Common Name in the client's TLS certificate before using it to find the user name in the Radiator database:

EAPTLSRewriteCertificateCommonName s/testUser/mikem/