Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 754 / 840

What Is a Distinguished Name?
754 Red Hat Certificate System Administrator’s Guide • September 2005
Distinguished Name Components
A DN identifies an entry in an LDAP directory. Because directories are hierarchical, DNs
identify the entry by its location as a path in a
hierarchical tree (much as a path in a file
system identifies a file). Generally, a DN begins with a specific common name, and
proceeds with increasingly broader areas of identification until the country name is
specified. DNs are typically made up of the following components (which are defined in the
X.520 standard):
CN=common name, OU=organizational unit, O=organization, L=locality,
ST=state or province, C=country name
These components are described in Table I-1. For more information on distinguished
names, see RFC 2253 (which replaces RFC 1779). You can find RFC 2253 at this URL:
http://www.ietf.org/rfc/rfc2253.txt
Note that if used in conjunction with an LDAP-compliant directory, Certificate System by
default recognizes components that are listed in Table I-2.
Table I-1 Definitions of standard DN components
Component Name Definition
CN
Common name A required component that identifies the person or object defined by the
entry. For example:
• CN=Jane Doe
• CN=corpDirectory.example.com
E
(deprecated)
Email address Identifies the email address of the entry. For example:
jdoe@example.com
The use of this component is discouraged by the PKIX standard; instead,
it recommends the use of
Subject Alternative Name Extension to associate
an email address with a certificate; see “subjectAltName” on page 740.
The reason for this is because it is usually too hard to have a
E
in a
directory structure; email addresses change too frequently.
OU
Organizational unit Identifies a unit within the organization. For example:
• OU=Sales
• OU=Manufacturing
O
Organization Identifies the organization in which the entry resides. For example:
• O=Example Corporation
• O=Public Power & Gas