diff --git a/src/crypto/x509/verify.go b/src/crypto/x509/verify.go
index 50f4d4a..121fd1b 100644
--- a/src/crypto/x509/verify.go
+++ b/src/crypto/x509/verify.go
@@ -20,6 +20,9 @@ import (
 
 // ignoreCN disables interpreting Common Name as a hostname. See issue 24151.
 var ignoreCN = !strings.Contains(os.Getenv("GODEBUG"), "x509ignoreCN=0")
+// if using Common Name as a hostname is enabled via x509ignoreCN=0,
+// warnCN enables a warning whenever Common Name is interpreted as a hostname.
+var warnCN = strings.Contains(os.Getenv("GODEBUG"), "x509warnCN=1")
 
 type InvalidReason int
 
@@ -1078,6 +1081,10 @@ func (c *Certificate) VerifyHostname(h string) error {
 	names := c.DNSNames
 	if c.commonNameAsHostname() {
 		names = []string{c.Subject.CommonName}
+		if warnCN {
+			fmt.Fprintf(os.Stderr, "x509: Warning - certificate relies on legacy Common Name field. " +
+				"Using CN without SAN is deprecated and will not work in future versions.\n")
+		}
 	}
 
 	candidateName := toLowerCaseASCII(h) // Save allocations inside the loop.