The certificate matching settings should be set to matching or matching. Certificate matching is more restrictive because it checks the login certificate against the list of certificates configured for the user. The option should be used only in specific guest account scenarios as described in Section 3.3.3, No Matching. For information on how to configure certificate matching options by using iManager, see Section 3.3, Configuring Certificate Matching.