@edwinchoi thanks for the report... Will fix it
 @edwinchoi can you verify the fix:

https://github.com/netty/netty/pull/3889

Thanks!
 @normanmaurer works as expected now, thanks!
 Fixed

OpenSSL SSLSession returns incorrect peer principal
According to the docs for `javax.net.ssl.SSLSession` (http://docs.oracle.com/javase/7/docs/api/javax/net/ssl/SSLSession.html#getPeerPrincipal()), `getPeerPrincipal` should be returning the identity of the peer.

The OpenSSL based implementation for Netty, however, is returning the identity of the issuer:
https://github.com/netty/netty/blob/netty-4.0.28.Final/handler/src/main/java/io/netty/handler/ssl/OpenSslEngine.java#L1406
`getPeerPrincipal()` calls `principal(certs)`, which casts to `X509Certificate` and calls `getIssuerX500Principal()` when it should be calling `getSubject500Principal()`.

The JDK based implementation returns the correct principal.

handler/src/main/java/io/netty/handler/ssl/OpenSslEngine.java
handler/src/main/java/io/netty/handler/ssl/OpenSslEngine.java
diff --git a/handler/src/main/java/io/netty/handler/ssl/OpenSslEngine.java b/handler/src/main/java/io/netty/handler/ssl/OpenSslEngine.java
index 53ef4334465..756c11fb163 100644
--- a/handler/src/main/java/io/netty/handler/ssl/OpenSslEngine.java
+++ b/handler/src/main/java/io/netty/handler/ssl/OpenSslEngine.java
@@ -1446,7 +1446,7 @@ public Principal getPeerPrincipal() throws SSLPeerUnverifiedException {
             if (peer == null || peer.length == 0) {
                 return null;
             }
-            return principal(peer);
+            return ((java.security.cert.X509Certificate) peer[0]).getSubjectX500Principal();
         }
 
         @Override
@@ -1455,11 +1455,7 @@ public Principal getLocalPrincipal() {
             if (local == null || local.length == 0) {
                 return null;
             }
-            return principal(local);
-        }
-
-        private Principal principal(Certificate[] certs) {
-            return ((java.security.cert.X509Certificate) certs[0]).getIssuerX500Principal();
+            return ((java.security.cert.X509Certificate) local[0]).getIssuerX500Principal();
         }
 
         @Override
