中文

Glossary

Distinguished Name (DN)

Last verified

Definition

Distinguished Name (DN) is the structured X.500-style name, built from attributes such as C, O and CN, that identifies a certificate's subject and issuer.

A distinguished name is a sequence of relative distinguished names (RDNs), each an attribute type and value. The usual attributes are Country (C), State or Province (ST), Locality (L), Organization (O), Organizational Unit (OU) and Common Name (CN). Every X.509 certificate has an issuer DN and a subject DN, and chain building matches a certificate's issuer DN against the subject DN of its issuer.

Why it matters

In TLS server certificates the subject DN identifies the owner only for OV and EV certificates, where the CA verifies the organization fields. For DV certificates the subject usually contains just a CN, because hostnames are carried in the SAN extension. When you generate a CSR, a DV CA ignores the organization details you type, and the Baseline Requirements no longer allow the OU attribute in publicly trusted TLS certificates. Issuer DNs still matter everywhere: they are how clients find the next certificate in a chain.

Example

openssl req -new -key example.com.key -out example.com.csr \
  -subj "/C=CN/ST=Beijing/L=Beijing/O=Example Ltd/CN=example.com"
openssl x509 -in cert.pem -noout -subject -issuer -nameopt RFC2253

In RFC 2253 output the attributes appear in reverse order, most specific first, e.g. CN=example.com,O=Example Ltd,....

Common misconceptions

  • Browsers check the hostname against the DN. They check the SAN extension; the CN inside the DN is ignored for hostname matching.
  • Whatever I put in the CSR appears in the certificate. The CA decides the final subject, and DV certificates drop unverified organization fields.

See also