Redis TLS client certificate rejected: which identity field does tls-auth-clients actually match?

I'm configuring mutual TLS on Redis 6.2+ using the documented directives: tls-port, tls-cert-file, tls-key-file, tls-ca-cert-file, and tls-auth-clients yes. The goal is to have the server reject client certificates whose identity does not match the connecting peer.

The uncertainty is the exact matching rule. The documentation does not clearly state whether Redis compares the client certificate's Common Name, its Subject Alternative Name, or both, nor whether the comparison is against the peer's IP address, a reverse-DNS result, or an expected hostname. This matters because behavior may also differ between OpenSSL-linked and wolfSSL-linked builds, and between Redis 6.2 and 7.x.

Before troubleshooting any handshake failure, I plan to rule out the obvious causes: an untrusted or self-signed CA not present in tls-ca-cert-file, and expired certificates. I can verify the baseline with openssl s_client and the Redis log.

Specifically:

• When tls-auth-clients yes is set, which certificate field (CN or SAN) does Redis use for client identity checks, and against what value is it compared?
• Does this behavior differ between OpenSSL and wolfSSL builds, or between 6.2 and 7.x?
• Is there a supported way to log why a client certificate was rejected?