Hi Mr. Colt,
Officially the CommonCryptoLib did not support SNC Client Encryption. SNC Client Encryption works with Secure Login Library 1.0
The snc/identity/as can be changed to SNCServiceUser and the SAP/ and domain name will be appended or not during SAP GUI login depending on which kind of connection you need. So you can set up your X.509 to CN=SNCServiceUser.
I would like to check you trace for verification, when the issue happens with failed SNC Client Encryption login.
KR
Valerie