Client identification over SSL

Which of the following is more appropriate to use as an identification field in a database to represent a client, when two-way SSL authentication is used?

1. The client's X500Principal

   OR

2. The thumbprint of开发者_运维百科 the client's certificate

---

What is appropriate depends on what you are doing with the authentication information, but in general I would guess that you want to use the subject distinguished name (DN) which you can retrieve with the java.security.cert.X509Certificate.getSubjectX500Principal method.

The thumbprint will change when the certificate expires and the user renews it, but of course the user's identity will remain the same.