# What Is Distinguished Name (DN)? Definition and Examples

> Distinguished Name (DN) is the structured X.500-style name, built from attributes such as C, O and CN, that identifies a certificate's subject and issuer.

Source: https://ssl.sh/glossary/distinguished-name/
Last updated: 2026-11-10

A distinguished name is a sequence of relative distinguished names (RDNs), each an attribute type and value. The usual attributes are Country (C), State or Province (ST), Locality (L), Organization (O), Organizational Unit (OU) and [Common Name](https://ssl.sh/glossary/common-name/) (CN). Every [X.509](https://ssl.sh/glossary/x509/) certificate has an issuer DN and a subject DN, and chain building matches a certificate's issuer DN against the subject DN of its issuer.

## Why it matters
In TLS server certificates the subject DN identifies the owner only for OV and EV certificates, where the CA verifies the organization fields. For DV certificates the subject usually contains just a CN, because hostnames are carried in the [SAN](https://ssl.sh/glossary/san/) extension. When you generate a CSR, a DV CA ignores the organization details you type, and the Baseline Requirements no longer allow the OU attribute in publicly trusted TLS certificates. Issuer DNs still matter everywhere: they are how clients find the next certificate in a chain.

## Example
```bash
openssl req -new -key example.com.key -out example.com.csr \
  -subj "/C=CN/ST=Beijing/L=Beijing/O=Example Ltd/CN=example.com"
openssl x509 -in cert.pem -noout -subject -issuer -nameopt RFC2253
```

In RFC 2253 output the attributes appear in reverse order, most specific first, e.g. `CN=example.com,O=Example Ltd,...`.

## Common misconceptions
- **Browsers check the hostname against the DN.** They check the SAN extension; the CN inside the DN is ignored for hostname matching.
- **Whatever I put in the CSR appears in the certificate.** The CA decides the final subject, and DV certificates drop unverified organization fields.

## Related terms

- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [CN](https://ssl.sh/zh/glossary/common-name/): CN 即通用名称，是证书主体中曾用来填写域名的属性；现代浏览器已忽略它，只按 SAN 扩展匹配域名。
- [SAN](https://ssl.sh/zh/glossary/san/): SAN 即主体备用名称，是 X.509 证书中列出其适用的所有域名、IP 地址等身份的扩展，客户端按它校验主机名。
- [CSR](https://ssl.sh/zh/glossary/csr/): CSR 是证书签名请求，包含申请者的公钥和希望写入证书的身份信息，用私钥签名后提交给 CA 以申请证书。
- [OV 证书](https://ssl.sh/zh/glossary/ov-certificate/): OV 证书是 CA 在验证域名控制权之外，还核实了证书中所写组织真实合法存在的 TLS 证书。
- [EV 证书](https://ssl.sh/zh/glossary/ev-certificate/): EV 证书是按照 CA/浏览器论坛《EV 指南》完成最严格身份审核后签发的 TLS 证书。