The security guide states that spaces MUST be removed from DN when adding them to users.properties. But JAAS certificate authentication only worked after adding spaces '\ ' to the DN after commas in the DN.
This was tested using the demo certs and example producer and consumer. The DN in users.properties file had to be:
client=CN=Unknown,\ OU=client,\ O=Unknown,\ L=Unknown,\ ST=Unknown,\ C=Unknown