pfSense

Sorry, I realized that it's not a bug immediately after clicking save, but I cannot edit anything :/

Even if it is enabled, it would still need GUI code to configure the behavior.

One could enable it via "Custom options", so there is no real GUI need for it. Given that it is a rather special Option I'd be fine with doing that as a custom option.

We currently force on username-as-common-name so I don't think you could override that behavior with this new option without some way to control which is used.

That is true, but it doesn't seem to affect "plugin /usr/local/lib/openvpn/plugins/openvpn-plugin-auth-script.so /usr/local/sbin/ovpn_auth_verify_async" (which pfsense also generates) as this script still has the actual common name from the cert (which --x509-username-field would affect) in addition to the user. If this common_name were overriden by the username then "Strict User-CN Matching" would always be true (it isn't, I checked which prompted me to try --x509-username-field). Or do I miss something else here?