HTCondorWiki: How To Use Proxies With Ssl

   SCHEDD.SEC_READ_AUTHENTICATION_METHODS = FS,TOKEN,SCITOKENS,SSL,GSI
   SCHEDD.AUTH_SSL_REQUIRE_CLIENT_CERTIFICATE = True
 
+Note that when using GSI as a fallback, a client should not be configured
+to use proxies with SSL authentication until the HTCondor-CE's mapfile has
+been updated to map the client's DNs. Otherwise, the SSL authentication
+will succeed with a mapped identity of 'unmapped@ssl', which will not be
+authorized.
+
 6. Once all of the peers of a given client or CE are authenticating
 successfully via SSL, you can upgrade to HTCondor-CE 6 and HTCondor 10.X.
 In order to use EGI Check-In tokens, the CE needs to be running HTCondor 10.4.0 or later.