diff --git a/etc/emqx.conf b/etc/emqx.conf
index 1479a18d2..341056344 100644
--- a/etc/emqx.conf
+++ b/etc/emqx.conf
@@ -925,6 +925,12 @@ listener.tcp.external.access.1 = allow all
 ## Value: Duration
 ## listener.tcp.external.proxy_protocol_timeout = 3s
 
+## Enable the option for X.509 certificate based authentication.
+## EMQX will use the common name of certificate as MQTT username.
+##
+## Value: cn | dn | crt
+## listener.tcp.external.peer_cert_as_username = cn
+
 ## The TCP backlog defines the maximum length that the queue of pending
 ## connections can grow to.
 ##