Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 763 / 840

DNs in Certificate System
Appendix I Distinguished Names 763
4.
Add the encoding order to the configuration file.
For example, if you want to specify two encoding values,
PrintableString
and
UniversalString
, and the encoding order is
PrintableString
first and
UniversalString
next, you would add the following line at the end of the
configuration file:
X500Name.directoryStringEncodingOrder=PrintableString,
UniversalString
5.
Save your changes and close the file.
6.
To verify that the encoding order are in effect, enroll for a certificate using the manual
enrollment form. Use
“John_Doe”
for CN.
7.
Go to the agent interface and approve your request.
8.
When you receive the certificate, use the
dumpasn1
tool to examine the encoding of
the certificate. For details about the
dumpasn1
tool, see CS Command-Line Tools
Guide .
The CN component of the subject name should be encoded as a
UniversalString
.
9.
Repeat Steps 6 through 8 above, but use
"John Smith
for CN this time.
The CN component of the subject name should be encoded as a PrintableString.
Role of Distinguished Names in Certificates
In certificates issued by Certificate System, DNs are used to identify the entity that owns the
certificate. In all cases, if you are using Certificate System with a directory, the format of
the DNs in your certificates should match the format of the DNs in your directory. It is not
necessary that the names match exactly; certificate mapping allows the subject DN in a
certificate to be different from the one in the directory.
DNs in End-Entity Certificates
In end-entity certificates issued by Certificate System, DNs are used to identify the end
entity that owns the certified key pair. The end entity is one of the following:
• The individual who owns the certified key pair (for personal or client certificates—to
form this type of DN, use the
CN
component to specify the user’s full name:
CN=<user’s_full_name>, OU=<user’s_division_name>,
O=<company_name>, C=<country_name>