diff --git a/openwisp_controller/config/base/vpn.py b/openwisp_controller/config/base/vpn.py
index f3270c852..cde022921 100644
--- a/openwisp_controller/config/base/vpn.py
+++ b/openwisp_controller/config/base/vpn.py
@@ -892,12 +892,12 @@ def _get_common_name(self):
         """
         d = self.config.device
         end = 63 - len(d.mac_address)
-        d.name = d.name[:end]
+        name = d.name[:end]
         unique_slug = shortuuid.ShortUUID().random(length=8)
         cn_format = app_settings.COMMON_NAME_FORMAT
-        if cn_format == "{mac_address}-{name}" and d.name == d.mac_address:
+        if cn_format == "{mac_address}-{name}" and name == d.mac_address:
             cn_format = "{mac_address}"
-        common_name = cn_format.format(**d.__dict__)[:55]
+        common_name = cn_format.format(**{**d.__dict__, "name": name})[:55]
         common_name = f"{common_name}-{unique_slug}"
         return common_name
 
diff --git a/openwisp_controller/config/tests/test_vpn.py b/openwisp_controller/config/tests/test_vpn.py
index 211ad4a06..c2451790d 100644
--- a/openwisp_controller/config/tests/test_vpn.py
+++ b/openwisp_controller/config/tests/test_vpn.py
@@ -413,6 +413,8 @@ def test_auto_create_cert_with_long_device_name(self):
         )
         client.full_clean()
         client.save()
+        # Ensure _get_common_name does not mutate device.name
+        self.assertEqual(d.name, device_name)
         # The last 9 characters gets truncated and replaced with unique id
         self.assertIn(
             "{mac_address}-{name}".format(**d.__dict__)[:-9], client._get_common_name()