diff --git a/main.go b/main.go
index 7a43ab6..be102c1 100644
--- a/main.go
+++ b/main.go
@@ -50,6 +50,7 @@ var (
 	connectCert     = connect.Flag("cert", "Client certificate chain for connecting to server (PEM).").ExistingFile()
 	connectKey      = connect.Flag("key", "Private key for client certificate, if not in same file (PEM).").ExistingFile()
 	connectStartTLS = connect.Flag("start-tls", "Enable StartTLS protocol ('ldap', 'mysql', 'postgres', 'smtp' or 'ftp').").Short('t').PlaceHolder("PROTOCOL").Enum("mysql", "postgres", "psql", "smtp", "ldap", "ftp")
+	connectAs       = connect.Flag("asuser", "With starttls, connect as this db user (or smtp ehlo)").Default("certigo").String()
 	connectTimeout  = connect.Flag("timeout", "Timeout for connecting to remote server (can be '5m', '1s', etc).").Default("5s").Duration()
 	connectPem      = connect.Flag("pem", "Write output as PEM blocks instead of human-readable format.").Short('m').Bool()
 	connectJSON     = connect.Flag("json", "Write output as machine-readable JSON format.").Short('j').Bool()
@@ -104,7 +105,7 @@ func main() {
 		}
 
 	case connect.FullCommand(): // Get certs by connecting to a server
-		connState, err := starttls.GetConnectionState(*connectStartTLS, *connectName, *connectTo, *connectCert, *connectKey, *connectTimeout)
+		connState, err := starttls.GetConnectionState(*connectStartTLS, *connectName, *connectTo, *connectAs, *connectCert, *connectKey, *connectTimeout)
 		if err != nil {
 			fmt.Fprintf(os.Stderr, "%s\n", strings.TrimSuffix(err.Error(), "\n"))
 			os.Exit(1)
diff --git a/starttls/starttls.go b/starttls/starttls.go
index 545a940..e78cb0f 100644
--- a/starttls/starttls.go
+++ b/starttls/starttls.go
@@ -62,9 +62,9 @@ func tlsConfigForConnect(connectName, clientCert, clientKey string) (*tls.Config
 // GetConnectionState connects to a TLS server, returning the connection state.
 // Currently, startTLSType can be one of "mysql", "postgres" or "psql", or the
 // empty string, which does a normal TLS connection. connectTo specifies the
-// address to connect to. connectName sets SNI.  connectCert and connectKey are
-// client certs
-func GetConnectionState(startTLSType, connectName, connectTo, clientCert, clientKey string, timeout time.Duration) (*tls.ConnectionState, error) {
+// address to connect to. connectName sets SNI.  connectAs sets db username, smtp ehlo
+// connectCert and connectKey are client certs
+func GetConnectionState(startTLSType, connectName, connectTo, connectAs, clientCert, clientKey string, timeout time.Duration) (*tls.ConnectionState, error) {
 	var state *tls.ConnectionState
 	var err error
 	var tlsConfig *tls.Config
@@ -124,7 +124,7 @@ func GetConnectionState(startTLSType, connectName, connectTo, clientCert, client
 			res <- connectResult{state, nil}
 		case "mysql":
 			mysql.RegisterTLSConfig("certigo", tlsConfig)
-			state, err = mysql.DumpTLS(fmt.Sprintf("certigo@tcp(%s)/?tls=certigo&timeout=%s", connectTo, timeout.String()))
+			state, err = mysql.DumpTLS(fmt.Sprintf("%s@tcp(%s)/?tls=certigo&timeout=%s", connectAs, connectTo, timeout.String()))
 			if err != nil {
 				res <- connectResult{nil, err}
 				return
@@ -132,7 +132,7 @@ func GetConnectionState(startTLSType, connectName, connectTo, clientCert, client
 			res <- connectResult{state, nil}
 		case "postgres", "psql":
 			// Setting sslmode to "require" skips verification.
-			url := fmt.Sprintf("postgres://certigo@%s/?sslmode=require&connect_timeout=%d", connectTo, timeout/time.Second)
+			url := fmt.Sprintf("postgres://%s@%s/?sslmode=require&connect_timeout=%d", connectAs, connectTo, timeout/time.Second)
 			if clientCert != "" {
 				url += fmt.Sprintf("&sslcert=%s", clientCert)
 			}
@@ -154,7 +154,7 @@ func GetConnectionState(startTLSType, connectName, connectTo, clientCert, client
 				res <- connectResult{nil, err}
 				return
 			}
-			err = client.Hello("certigo")
+			err = client.Hello(connectAs)
 			if err != nil {
 				res <- connectResult{nil, err}
 				return