This authentication method uses SSL client certificates to perform
    authentication. It is therefore only available for SSL connections.
    When using this authentication method, the server will require that
    the client provide a valid, trusted certificate.  No password prompt
    will be sent to the client.  The cn (Common Name)
    attribute of the certificate
    will be compared to the requested database user name, and if they match
    the login will be allowed.  User name mapping can be used to allow
    cn to be different from the database user name.
   
The following configuration options are supported for SSL certificate authentication:
mapAllows for mapping between system and database user names. See Section 20.2 for details.
    In a pg_hba.conf record specifying certificate
    authentication, the authentication option clientcert is
    assumed to be verify-ca or verify-full,
    and it cannot be turned off since a client certificate is necessary for this
    method. What the cert method adds to the basic
    clientcert certificate validity test is a check that the
    cn attribute matches the database user name.