X509SubjectName

X509SubjectName refers to the distinguished name (DN) that identifies the subject of an X.509 certificate. It is stored in the certificate's TBSCertificate.subject field and is encoded as a Name, which in turn is a sequence of relative distinguished names (RDNs). Each RDN is a set of one or more AttributeTypeAndValue pairs, representing attributes such as country, organization, and common name.

The subject name is encoded using ASN.1 and DER as defined in RFC 5280. Typical attribute types include C (countryName), ST (state or provinceName), L (localityName), O (organizationName), OU (organizationalUnitName), and CN (commonName). The most legible form is the LDAP-style string, for example: CN=server.example.com, OU=Engineering, O=Example Corp, C=US. The exact ordering of RDNs can vary, and multiple values for the same attribute may occur in some certificates.

In practice, the subject name has been used historically to bind a certificate to an entity. In modern TLS usage, the Subject Alternative Name (SAN) extension is the preferred mechanism for listing identities (such as DNS names or IP addresses) that the certificate should protect. If SAN is present, many clients prefer it over the subject name for hostname validation; some implementations may ignore CN for TLS matching if SAN exists.

Security considerations include the fact that the subject name is a property asserted by the issuing CA and can be configured to resemble an organization's identity, but it does not by itself prove authenticity without the CA’s chain of trust. Parsing libraries provide access to the X509SubjectName for inspection and validation.