As a part of the STARTTLS form of authentication and encryption, certificates are usually exchanged. This ${cert_subject} macro is assigned the distinguished name (the DN) of the certificate presented by the other side. That value might look like this:

/C=US/ST=California/L=Berkeley/O=Sendmail.org/CN=smtp.sendmail.org/

See Section 10.10.8.1 for an illustration of one use for ${cert_subject}. See Section 21.6.2 to find how and why the value in this macro undergoes special translation.

${cert_subject} is transient. If defined in the configuration file or in the command line, that definition can be ignored by sendmail. Note that a $& prefix is necessary when you reference this macro in rules (that is, use $&{cert_subject}, not ${cert_subject}).