Netscape Certificate Management System 6.1, Administrator'S Manual

Page: 758 / 840

DNs in Certificate Management System
758 Netscape Certificate Management System Administrator’s Guide • February 2003
DNs in End-Entity Certificates
In end-entity certificates issued by Certificate Management System, DNs are used
to identify the end entity that owns the certified key pair. The end entity is one of
the following:
• The individual who owns the certified key pair (for personal or client
certificates—to form this type of DN, use the
CN
component to specify the
user’s full name:
CN=<user’s_full_name>, OU=<user’s_division_name>,
O=<company_name>, C=<country_name>
For example:
CN=Jane Doe, OU=Human Resources, O=Example Corporation, C=US
• The server that owns the certified key pair (for SSL server certificates)—to form
this type of DN, use the
CN
component to specify the server’s fully qualified
host name in the form
<machine_name>.<your_domain>.<domain>
:
CN=<host_name>, OU=<division_name>, O=<company_name>,
C=<country_name>
For example:
CN=corpDirectory.example.com, OU=Human Resources, O=Example
Corporation, C=US
When clients such as Netscape Navigator receive a server certificate, they
expect the
CN
component of the certificate’s subject to match the host name in
the URL. If the name in the certificate and the host name of the server do not
match, Navigator notifies the user and gives the user the choice of not
connecting to the server.
For example, if Navigator goes to the URL
https://corpDirectory.example.com
and receives a certificate from the
server, it expects the
CN
component of the certificate’s subject to be
corpDirectory.example.com
. If the
CN
component has a different value (for
example,
corpDir.example.com
), Navigator notifies the user that the
certificate’s subject name does not match the host name in the URL.
DNs in CA Certificates
In CA certificates issued by Certificate Management System (for both root and
subordinate CAs), DNs are used to identify the authority who owns the certified
key pair.
To form this type of distinguished name, use the
CN
component to specify the name
of your CA:
CN=<CA_name>, O=<company_name>, C=<country_name>