🏷️ Subject DN Builder

Fill in the fields below to build the Subject Distinguished Name string used when generating a CSR — the exact format most openssl req -subj commands and CSR forms expect.

Common Name (CN) — your domain

Organization (O)

Organizational Unit (OU)

Locality / City (L)

State / Province (ST)

Country Code (C) — 2 letters

Two spellings of the same name

Nothing leaves the page; the builder just assembles strings. Empty fields are dropped, the country is upper-cased, and you get the default values back in both conventions:

/C=US/ST=California/L=San Francisco/O=Example Inc/OU=IT/CN=example.com
CN=example.com,OU=IT,O=Example Inc,L=San Francisco,ST=California,C=US

The first is what openssl req -subj takes. The second is RFC 2253, the form Java, LDAP and most log output use, and it is not a different name - RFC 2253 prints the most specific component first, so it is the same sequence read backwards. Values are escaped there with a backslash before any of , + " \ < > ;.

A forward slash inside a value breaks the -subj form, because that is the character openssl splits on. An organisation like "Example Inc / Europe" has to be written O=Example Inc \/ Europe on the command line; the builder does not add that escape for you.

What each field is for

CN - the hostname. Keep it identical to the first entry in your SAN list; clients match on SAN and ignore CN entirely.
O, L, ST - the legal organisation and where it is. These survive only on OV and EV certificates, where the CA verifies them against public records. On a domain-validated certificate they are dropped.
C - two-letter ISO 3166-1 code, upper case, and no other length is valid.

Frequently asked questions

What is the country code for the United Kingdom?

GB, not UK. The field takes ISO 3166-1 alpha-2 codes, so it is also DE for Germany, JP for Japan and AU for Australia. A wrong or invented code is a common reason a CSR is rejected on submission.

Why did my OU disappear from the issued certificate?

Public CAs have been prohibited from putting organizationalUnitName in TLS certificates since September 2022. Fill it in for an internal CA if it helps you, but expect a public CA to strip it.

Does the field order matter?

A DN is an ordered sequence, and the conventional order is broadest to narrowest: C, ST, L, O, OU, CN. Reordering produces a technically different DN, which matters when something is matching subjects exactly.