diff --git a/plugin/pkg/auth/authenticator/request/x509/x509.go b/plugin/pkg/auth/authenticator/request/x509/x509.go
index a86b4c576ff..827df5a1b43 100644
--- a/plugin/pkg/auth/authenticator/request/x509/x509.go
+++ b/plugin/pkg/auth/authenticator/request/x509/x509.go
@@ -18,6 +18,7 @@ package x509
 
 import (
 	"crypto/x509"
+	"encoding/asn1"
 	"net/http"
 
 	"k8s.io/kubernetes/pkg/auth/user"
@@ -104,7 +105,13 @@ var DNSNameUserConversion = UserConversionFunc(func(chain []*x509.Certificate) (
 
 // EmailAddressUserConversion builds user info from a certificate chain using the first EmailAddress on the certificate
 var EmailAddressUserConversion = UserConversionFunc(func(chain []*x509.Certificate) (user.Info, bool, error) {
+	var emailAddressOID asn1.ObjectIdentifier = []int{1, 2, 840, 113549, 1, 9, 1}
 	if len(chain[0].EmailAddresses) == 0 {
+		for _, name := range chain[0].Subject.Names {
+			if name.Type.Equal(emailAddressOID) {
+				return &user.DefaultInfo{Name: name.Value.(string)}, true, nil
+			}
+		}
 		return nil, false, nil
 	}
 	return &user.DefaultInfo{Name: chain[0].EmailAddresses[0]}, true, nil