Distinguished name syntax

Edit online

The Distinguished Name (DN) syntax supported by this server is based on RFC 2253.

The Backus-Naur Form (BNF) syntax is defined as follows: 
<name> ::= <name-component> ( <spaced-separator> )
| <name-component> <spaced-separator> <name>

<spaced-separator> ::= <optional-space>
<separator>
<optional-space>

<separator> ::="," | ";"

<optional-space> ::= ( <CR> ) *( " " )

<name-component> ::= <attribute>
| <attribute> <optional-space> "+"
<optional-space> <name-component>

<attribute> ::= <string>
| <key> <optional-space> "=" <optional-space> <string>

<key> ::= 1*( <keychar> ) | "OID." <oid> | "oid." <oid>
<keychar> ::= letters, numbers, and space

<oid> ::= <digitstring> | <digitstring> "." <oid>
<digitstring> ::= 1*<digit>
<digit> ::= digits 0-9

<string> ::= *( <stringchar> | <pair> )
| '"' *( <stringchar> | <special> | <pair> ) '"'
| "#" <hex>


<special> ::= "," | "=" | <CR> | "+" | "<" |">"
| "#" | ";"

<pair> ::= "\" ( <special> | "\" | '"')
<stringchar> ::= any character except <special> or "\" or '"'


<hex> ::= 2*<hexchar>
<hexchar> ::= 0-9, a-f, A-F

A semicolon ; character can be used to separate RDNs in a distinguished name, although the comma , character is the typical notation.

White-space characters (spaces) might be present on either side of the comma or semicolon. The white-space characters are ignored, and the semicolon is replaced with a comma.

In addition, space (' ' ASCII 32) characters may be present either before or after a '+' or '='. These space characters are ignored when parsing.

A value may be surrounded by double quotation ('"' ACSII 34) characters, which are not part of the value. Inside the quoted value, the following characters can occur without being interpreted as escape characters:
  • A space or "#" character occurring at the beginning of the string
  • A space character occurring at the end of the string
  • One of the characters "'", "=", "+", "\", "<", ">", or ";"

Alternatively, a single character to be escaped may be prefixed by a backslash ('\' ASCII 92). This method can be used to escape any of the characters listed previously and the double quotation marks ('"' ASCII 34) character.

This notation is designed to be convenient for common forms of names. The following example is a distinguished name written using this notation. First is a name containing three components. The first of the components is a multivalued RDN®. A multivalued RDN contains more than one attribute:value pair and can be used to distinctly identify a specific entry in cases where a simple CN value might be ambiguous: 
OU=Sales+CN=J. Smith,O=Widget Inc.,C=US