diff -ru /tmp/zabbix-5.0.2/include/db.h ./include/db.h
--- /tmp/zabbix-5.0.2/include/db.h	2020-07-06 11:54:32.000000000 +0200
+++ ./include/db.h	2020-09-08 11:20:44.809501688 +0200
@@ -599,11 +599,12 @@
 int	DBget_user_names(zbx_uint64_t userid, char **alias, char **name, char **surname);
 
 void	DBregister_host(zbx_uint64_t proxy_hostid, const char *host, const char *ip, const char *dns,
-		unsigned short port, unsigned int connection_type, const char *host_metadata, unsigned short flag,
-		int now);
+		unsigned short port, unsigned int connection_type, const char *tls_issuer, unsigned short flag, int now,
+		const char *host_metadata, const char *tls_subject);
+
 void	DBregister_host_prepare(zbx_vector_ptr_t *autoreg_hosts, const char *host, const char *ip, const char *dns,
-		unsigned short port, unsigned int connection_type, const char *host_metadata, unsigned short flag,
-		int now);
+		unsigned short port, unsigned int connection_type, const char *host_metadata, const char *tls_subject,
+		const char *tls_issuer, unsigned short flag, int now);
 void	DBregister_host_flush(zbx_vector_ptr_t *autoreg_hosts, zbx_uint64_t proxy_hostid);
 void	DBregister_host_clean(zbx_vector_ptr_t *autoreg_hosts);
 
diff -ru /tmp/zabbix-5.0.2/src/libs/zbxdbhigh/db.c ./src/libs/zbxdbhigh/db.c
--- /tmp/zabbix-5.0.2/src/libs/zbxdbhigh/db.c	2020-07-06 11:54:32.000000000 +0200
+++ ./src/libs/zbxdbhigh/db.c	2020-09-08 14:46:25.612818308 +0200
@@ -42,6 +42,8 @@
 	char		*ip;
 	char		*dns;
 	char		*host_metadata;
+	char		*tls_subject;
+	char		*tls_issuer;
 	int		now;
 	unsigned short	port;
 	unsigned short	flag;
@@ -1454,13 +1456,13 @@
  ******************************************************************************/
 void	DBregister_host(zbx_uint64_t proxy_hostid, const char *host, const char *ip, const char *dns,
 		unsigned short port, unsigned int connection_type, const char *host_metadata, unsigned short flag,
-		int now)
+		int now, const char *tls_subject, const char *tls_issuer)
 {
 	zbx_vector_ptr_t	autoreg_hosts;
 
 	zbx_vector_ptr_create(&autoreg_hosts);
 
-	DBregister_host_prepare(&autoreg_hosts, host, ip, dns, port, connection_type, host_metadata, flag, now);
+	DBregister_host_prepare(&autoreg_hosts, host, ip, dns, port, connection_type, host_metadata, tls_subject, tls_issuer, flag, now);
 	DBregister_host_flush(&autoreg_hosts, proxy_hostid);
 
 	DBregister_host_clean(&autoreg_hosts);
@@ -1498,12 +1500,14 @@
 	zbx_free(autoreg_host->ip);
 	zbx_free(autoreg_host->dns);
 	zbx_free(autoreg_host->host_metadata);
+	zbx_free(autoreg_host->tls_subject);
+	zbx_free(autoreg_host->tls_issuer);
 	zbx_free(autoreg_host);
 }
 
 void	DBregister_host_prepare(zbx_vector_ptr_t *autoreg_hosts, const char *host, const char *ip, const char *dns,
-		unsigned short port, unsigned int connection_type, const char *host_metadata, unsigned short flag,
-		int now)
+		unsigned short port, unsigned int connection_type, const char *host_metadata, const char *tls_subject,
+		const char *tls_issuer, unsigned short flag, int now)
 {
 	zbx_autoreg_host_t	*autoreg_host;
 	int 			i;
@@ -1528,6 +1532,8 @@
 	autoreg_host->port = port;
 	autoreg_host->connection_type = connection_type;
 	autoreg_host->host_metadata = zbx_strdup(NULL, host_metadata);
+	autoreg_host->tls_subject = zbx_strdup(NULL, tls_subject);
+	autoreg_host->tls_issuer = zbx_strdup(NULL, tls_issuer);
 	autoreg_host->flag = flag;
 	autoreg_host->now = now;
 
@@ -1702,7 +1708,7 @@
 		autoreg_hostid = DBget_maxid_num("autoreg_host", create);
 
 		zbx_db_insert_prepare(&db_insert, "autoreg_host", "autoreg_hostid", "proxy_hostid", "host", "listen_ip",
-				"listen_dns", "listen_port", "tls_accepted", "host_metadata", "flags", NULL);
+				"listen_dns", "listen_port", "tls_accepted", "host_metadata", "tls_subject", "tls_issuer", "flags", NULL);
 	}
 
 	if (0 != (update = autoreg_hosts->values_num - create))
@@ -1724,7 +1730,8 @@
 			zbx_db_insert_add_values(&db_insert, autoreg_host->autoreg_hostid, proxy_hostid,
 					autoreg_host->host, autoreg_host->ip, autoreg_host->dns,
 					(int)autoreg_host->port, (int)autoreg_host->connection_type,
-					autoreg_host->host_metadata, autoreg_host->flag);
+					autoreg_host->host_metadata, autoreg_host->tls_subject,
+					autoreg_host->tls_issuer, autoreg_host->flag);
 		}
 		else
 		{
diff -ru /tmp/zabbix-5.0.2/src/libs/zbxdbhigh/dbschema.c ./src/libs/zbxdbhigh/dbschema.c
--- /tmp/zabbix-5.0.2/src/libs/zbxdbhigh/dbschema.c	2020-07-13 09:56:50.000000000 +0200
+++ ./src/libs/zbxdbhigh/dbschema.c	2020-09-08 13:13:26.109934184 +0200
@@ -1409,6 +1409,8 @@
 		{"host_metadata",	"",	NULL,	NULL,	255,	ZBX_TYPE_CHAR,	ZBX_NOTNULL,	0},
 		{"flags",	"0",	NULL,	NULL,	0,	ZBX_TYPE_INT,	ZBX_NOTNULL,	0},
 		{"tls_accepted",	"1",	NULL,	NULL,	0,	ZBX_TYPE_INT,	ZBX_NOTNULL,	0},
+		{"tls_issuer",	"",	NULL,	NULL,	1024,	ZBX_TYPE_CHAR,	ZBX_NOTNULL | ZBX_PROXY,	0},
+		{"tls_subject",	"",	NULL,	NULL,	1024,	ZBX_TYPE_CHAR,	ZBX_NOTNULL | ZBX_PROXY,	0},
 		{0}
 		},
 		NULL
diff -ru /tmp/zabbix-5.0.2/src/libs/zbxdbhigh/proxy.c ./src/libs/zbxdbhigh/proxy.c
--- /tmp/zabbix-5.0.2/src/libs/zbxdbhigh/proxy.c	2020-07-06 11:54:32.000000000 +0200
+++ ./src/libs/zbxdbhigh/proxy.c	2020-09-08 11:18:39.230370345 +0200
@@ -4379,7 +4379,7 @@
 			continue;
 		}
 
-		DBregister_host_prepare(&autoreg_hosts, host, ip, dns, port, connection_type, host_metadata, flags,
+		DBregister_host_prepare(&autoreg_hosts, host, ip, dns, port, 0, 0, connection_type, host_metadata, flags,
 				itemtime);
 	}
 
diff -ru /tmp/zabbix-5.0.2/src/zabbix_server/operations.c ./src/zabbix_server/operations.c
--- /tmp/zabbix-5.0.2/src/zabbix_server/operations.c	2020-07-06 11:54:32.000000000 +0200
+++ ./src/zabbix_server/operations.c	2020-09-08 13:45:30.325840039 +0200
@@ -470,7 +470,7 @@
 	else if (EVENT_OBJECT_ZABBIX_ACTIVE == event->object)
 	{
 		result = DBselect(
-				"select proxy_hostid,host,listen_ip,listen_dns,listen_port,flags,tls_accepted"
+				"select proxy_hostid,host,listen_ip,listen_dns,listen_port,flags,tls_accepted,tls_subject,tls_issuer"
 				" from autoreg_host"
 				" where autoreg_hostid=" ZBX_FS_UI64,
 				event->objectid);
@@ -555,6 +555,12 @@
 					zbx_db_insert_add_values(&db_insert, hostid, proxy_hostid, row[1], row[1],
 						tls_accepted, tls_accepted, psk_identity, psk);
 				}
+				else if (ZBX_TCP_SEC_TLS_CERT == tls_accepted)
+				{
+					zbx_db_insert_prepare(&db_insert, "hosts", "hostid", "proxy_hostid", "host",
+							"name", "tls_subject", "tls_issuer", "tls_accept", NULL);
+					zbx_db_insert_add_values(&db_insert, hostid, proxy_hostid, row[1], row[1],row[7],row[8],ZBX_TCP_SEC_TLS_CERT);
+				}
 				else
 				{
 					zbx_db_insert_prepare(&db_insert, "hosts", "hostid", "proxy_hostid", "host",
diff -ru /tmp/zabbix-5.0.2/src/zabbix_server/trapper/active.c ./src/zabbix_server/trapper/active.c
--- /tmp/zabbix-5.0.2/src/zabbix_server/trapper/active.c	2020-07-06 11:54:32.000000000 +0200
+++ ./src/zabbix_server/trapper/active.c	2020-09-08 14:45:16.531098418 +0200
@@ -43,12 +43,14 @@
  *             host_metadata - [IN] host metadata                             *
  *             flag          - [IN] flag describing interface type            *
  *             interface     - [IN] interface value if flag is not default    *
+ *             tls_subject   - [IN] TLS subject of the host if using TLS CERT *
+ *             tls_issuer    - [IN] TLS issuer of the host if using TLS CERT *
  *                                                                            *
  * Comments: helper function for get_hostid_by_host                           *
  *                                                                            *
  ******************************************************************************/
 static void	db_register_host(const char *host, const char *ip, unsigned short port, unsigned int connection_type,
-		const char *host_metadata, zbx_conn_flags_t flag, const char *interface)
+		const char *host_metadata, zbx_conn_flags_t flag, const char *interface, const char *tls_subject, const char *tls_issuer)
 {
 	char		dns[INTERFACE_DNS_LEN_MAX];
 	char		ip_addr[INTERFACE_IP_LEN_MAX];
@@ -84,7 +86,7 @@
 	if (0 != (program_type & ZBX_PROGRAM_TYPE_SERVER))
 	{
 		DBregister_host(0, host, p_ip, p_dns, port, connection_type, host_metadata, (unsigned short)flag,
-				(int)time(NULL));
+				(int)time(NULL), tls_subject, tls_issuer);
 	}
 	else if (0 != (program_type & ZBX_PROGRAM_TYPE_PROXY))
 		DBproxy_register_host(host, p_ip, p_dns, port, connection_type, host_metadata, (unsigned short)flag);
@@ -121,6 +123,40 @@
 
 		ret = SUCCEED;
 	}
+	else if (ZBX_TCP_SEC_TLS_CERT == sock->connection_type){
+		zbx_tls_conn_attr_t	attr;
+		char        *subject_host = NULL;
+		if (SUCCEED != zbx_tls_get_attr_cert(sock, &attr))
+		{
+			THIS_SHOULD_NEVER_HAPPEN;
+
+			zabbix_log(LOG_LEVEL_WARNING, "cannot get connection attributes for host"
+					" \"%s\"", host);
+			goto out;
+		}
+
+
+		/* simplified match, not compliant with RFC 4517, 4518 */
+		/*if ('\0' != *row[3] && 0 != strcmp(row[3], attr.issuer))
+		{
+			zbx_snprintf(error, MAX_STRING_LEN, "certificate issuer does not match for"
+					" host \"%s\"", host);#			goto done;
+		}
+		*/
+		/* simplified match, not compliant with RFC 4517, 4518 */
+		if ( FAIL == zbx_regexp_sub(attr.subject, "^CN=([^\\.]+)","\\1",&subject_host)){
+			zabbix_log(LOG_LEVEL_WARNING, "certificate subject does not match CN=hostname"
+					" host \"%s\", subject: \"%s\"", host, attr.subject);
+			goto out;
+		}
+		if (0 != strcmp(host, subject_host))
+		{
+			zabbix_log(LOG_LEVEL_WARNING, "certificate subject does not match for"
+					" host \"%s\", subject: \"%s\"", host, subject_host);
+			goto out;
+		}
+		ret = SUCCEED;
+	}
 	else if (ZBX_TCP_SEC_UNENCRYPTED == sock->connection_type)
 	{
 		ret = SUCCEED;
@@ -157,13 +193,15 @@
 		const char *host_metadata, zbx_conn_flags_t flag, const char *interface, zbx_uint64_t *hostid,
 		char *error)
 {
-	char		*host_esc, *ch_error, *old_metadata, *old_ip, *old_dns, *old_flag, *old_port;
+	char		*host_esc, *ch_error, *old_metadata, *old_ip, *old_dns, *old_flag, *old_port, *tls_subject, *tls_issuer;
 	DB_RESULT	result;
 	DB_ROW		row;
 	int		ret = FAIL;
 	unsigned short	old_port_v;
 	int		tls_offset = 0;
 	zbx_conn_flags_t	old_flag_v;
+	tls_subject="";
+	tls_issuer="";
 
 	zabbix_log(LOG_LEVEL_DEBUG, "In %s() host:'%s' metadata:'%s'", __func__, host, host_metadata);
 
@@ -229,9 +267,10 @@
 			if ('\0' != *row[3] && 0 != strcmp(row[3], attr.issuer))
 			{
 				zbx_snprintf(error, MAX_STRING_LEN, "certificate issuer does not match for"
-						" host \"%s\"", host);
+						" host \"%s\", issuer: \"%s\", expected \"%s\"", host,attr.issuer, row[3]);
 				goto done;
 			}
+			tls_issuer = attr.issuer;
 
 			/* simplified match, not compliant with RFC 4517, 4518 */
 			if ('\0' != *row[4] && 0 != strcmp(row[4], attr.subject))
@@ -240,6 +279,8 @@
 						" host \"%s\"", host);
 				goto done;
 			}
+			tls_subject = attr.subject;
+			
 		}
 #if defined(HAVE_GNUTLS) || (defined(HAVE_OPENSSL) && defined(HAVE_OPENSSL_WITH_PSK))
 		else if (ZBX_TCP_SEC_TLS_PSK == sock->connection_type)
@@ -278,7 +319,7 @@
 				(ZBX_CONN_DNS == flag && ( 0 != strcmp(old_dns, interface) || old_port_v != port)) ||
 				(old_flag_v != flag))
 		{
-			db_register_host(host, ip, port, sock->connection_type, host_metadata, flag, interface);
+			db_register_host(host, ip, port, sock->connection_type, host_metadata, flag, interface, tls_subject, tls_issuer);
 		}
 
 		if (HOST_STATUS_MONITORED != atoi(row[1]))
@@ -293,9 +334,14 @@
 	else
 	{
 		zbx_snprintf(error, MAX_STRING_LEN, "host [%s] not found", host);
-
-		if (SUCCEED == zbx_autoreg_check_permissions(host, ip, port, sock))
-			db_register_host(host, ip, port, sock->connection_type, host_metadata, flag, interface);
+		if (SUCCEED == zbx_autoreg_check_permissions(host, ip, port, sock)){
+			zbx_tls_conn_attr_t	attr;
+			if((ZBX_TCP_SEC_TLS_CERT == sock->connection_type) && (SUCCEED == zbx_tls_get_attr_cert(sock, &attr))){
+				tls_subject = attr.subject;
+				tls_issuer = attr.issuer;
+			}
+			db_register_host(host, ip, port, sock->connection_type, host_metadata, flag, interface,tls_subject,tls_issuer);
+		}
 	}
 done:
 	DBfree_result(result);
