Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

B.2. Distinguished Names

Overview
Copy link

Historically, distinguished names (DN) are defined as the primary keys in an X.500 directory structure. However, DNs have come to be used in many other contexts as general purpose identifiers. In Apache CXF, DNs occur in the following contexts:
  • X.509 certificates—for example, one of the DNs in a certificate identifies the owner of the certificate (the security principal).
  • LDAP—DNs are used to locate objects in an LDAP directory tree.

String representation of DN
Copy link

Although a DN is formally defined in ASN.1, there is also an LDAP standard that defines a UTF-8 string representation of a DN (see RFC 2253). The string representation provides a convenient basis for describing the structure of a DN.
Note
The string representation of a DN does not provide a unique representation of DER-encoded DN. Hence, a DN that is converted from string format back to DER format does not always recover the original DER encoding.

DN string example
Copy link

The following string is a typical example of a DN: 
C=US,O=IONA Technologies,OU=Engineering,CN=A. N. Other
Copy to Clipboard Toggle word wrap

Structure of a DN string
Copy link

A DN string is built up from the following basic elements:

OID
Copy link

An OBJECT IDENTIFIER (OID) is a sequence of bytes that uniquely identifies a grammatical construct in ASN.1.

Attribute types
Copy link

The variety of attribute types that can appear in a DN is theoretically open-ended, but in practice only a small subset of attribute types are used. Table B.1, “Commonly Used Attribute Types” shows a selection of the attribute types that you are most likely to encounter:
Expand
Table B.1. Commonly Used Attribute Types
String RepresentationX.500 Attribute TypeSize of DataEquivalent OID
C
countryName
2
2.5.4.6
O
organizationName
1...64
2.5.4.10
OU
organizationalUnitName
1...64
2.5.4.11
CN
commonName
1...64
2.5.4.3
ST
stateOrProvinceName
1...64
2.5.4.8
L
localityName
1...64
2.5.4.7
STREET
streetAddress
  
DC
domainComponent
  
UID
userid
  

AVA
Copy link

An attribute value assertion (AVA) assigns an attribute value to an attribute type. In the string representation, it has the following syntax: 
<attr-type>=<attr-value>
Copy to Clipboard Toggle word wrap
For example: 
CN=A. N. Other
Copy to Clipboard Toggle word wrap
Alternatively, you can use the equivalent OID to identify the attribute type in the string representation (see Table B.1, “Commonly Used Attribute Types” ). For example: 
2.5.4.3=A. N. Other
Copy to Clipboard Toggle word wrap

RDN
Copy link

A relative distinguished name (RDN) represents a single node of a DN (the bit that appears between the commas in the string representation). Technically, an RDN might contain more than one AVA (it is formally defined as a set of AVAs). However, this almost never occurs in practice. In the string representation, an RDN has the following syntax: 
<attr-type>=<attr-value>[+<attr-type>=<attr-value> ...]
Copy to Clipboard Toggle word wrap
Here is an example of a (very unlikely) multiple-value RDN: 
OU=Eng1+OU=Eng2+OU=Eng3
Copy to Clipboard Toggle word wrap
Here is an example of a single-value RDN: 
OU=Engineering
Copy to Clipboard Toggle word wrap
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat