Does the certificate Subject contain the UPN?
Failing that, do either the Subject or the Subject Alternative Name contain a value that is natively found in the identity store (I assume you're looking them up in AD?). I have seen ISE search the user's Email attribute and match on that (authentication successful) instead of the UPN. I never really figured out how this ISE logic works, and perhaps it was its ambiguity resolution (because user existed in multiple domains).
