APM Session Variable Not Being Cached

Generally speaking, session.ssl.cert.cn isn't a session variable that gets populated. Try:

session.ssl.cert.subject

If you're wondering which variables are getting set in the access policy, try this from the command line:

sessiondump -allkeys