When apiserver rejects a connection with invalid certificate it outputs

E0213 06:23:55.085394       1 authentication.go:74] "Unable to authenticate the request" err="verifying certificate SN=5424633604232311936, SKID=, AKID=14:64:1A:3C:91:F9:81:EA:37:A8:64:3C:2E:64:B5:9E:7C:A4:19:52 failed: x509: certificate signed by unknown authority"

That makes certificate detection complicated, as we have to match known certs using serial number. Instead kube-apiserver should output Common Name and issuer's Common Name so that admins could identify faulty certificate easier