Netscape Certificate Management System 6.1, Administrator'S Manual

Page: 759 / 840

DNs in Certificate Management System
Appendix I Distinguished Names 759
For example:
CN=Example Corporation Certificate Authority, O=Example
Corporation, C=US
DN Patterns and Certificate Subject Names
You can configure Certificate Management System to issue certificates with subject
names that are formulated from the directory attributes and entry DN. The
dnpattern
configuration variable of the automated-enrollment modules enable
you to configure the server to issue certificates with required subject names. Note
that
dnpattern
is a string representing a subject name pattern to formulate from
the directory attributes and entry DN. If empty or not set, Certificate Management
System uses the LDAP entry DN as the certificate subject name.
The
dnpattern
configuration variable supports escaped commas and multiple
attribute variable assertions (AVAs) in a RDN. Below is the syntax for the DN
pattern followed by examples.
Syntax
dnPattern := rdnPattern *[ "," rdnPattern ]
rdnPattern := avaPattern *[ "+" avaPattern ]
avaPattern := name "=" value | name "=" "$attr" "." attrName [ "."
attrNumber ] | name "="
"$dn" "." attrName [ "." attrNumber ] | "$dn" "." "$rdn" "." number
Example 1
If the configured DN pattern is
E=$attr.mail.1, CN=$attr.cn, OU=$dn.ou.2, O=$dn.o, C=US
LDAP entry:
dn: UID=jdoe, OU=IS, OU=people, O=example.com
LDAP attributes:
cn: Jane Doe
LDAP attributes:
mail: jdoe@example.com
The subject name formulated will be as follows:
E=jdoe@example.com, CN=Jane Doe, OU=people, O=example.com, C=US
E=
the first ‘mail’ LDAP attribute value in user’s entry.
CN=
the (first) ‘
cn
’ LDAP attribute value in the user’s entry.
OU=
the second ‘
ou
’ value in the user’s entry DN.
O=
the (first) ‘
o
’ value in the user’s entry DN.
C=
the string ‘US’