(PowerShell) Get Certificate Distinguished Name in .NET Format

See more Certificates Examples

Certificate distinguished names (DN's), in the real world, can be constructed in various ways. Some systems expect certain ways of doing things. This example demonstrates how to get a DN (or SimpleName) exactly as .NET would return it.

This example requires Chilkat v9.5.0.96.

Chilkat .NET Downloads Chilkat .NET Assemblies

Add-Type -Path "C:\chilkat\ChilkatDotNet47-9.5.0-x64\ChilkatDotNet47.dll"

$cert = New-Object Chilkat.Cert

$success = $cert.LoadFromFile("qa_data/certs/testCert.cer")
if ($success -eq $false) {
    $($cert.LastErrorText)
    exit
}

# In 99% of all cases, Chilkat already returns the Distinguished Name in the identical format as .NET.
# 
# In most cases, (internal to the certificate) the ASN.1 for the certificate's Subject 
# contains a sesquence of OIDs and values, where each OID is the single item in a SET.
# For example:

# SEQUENCE (3 elem)
#       SET (1 elem)
#         SEQUENCE (2 elem)
#           OBJECT IDENTIFIER 2.5.4.6 countryName (X.520 DN component)
#           PrintableString FR
#       SET (1 elem)
#         SEQUENCE (2 elem)
#           OBJECT IDENTIFIER 2.5.4.12 title (X.520 DN component)
#           UTF8String Mdecin
#       SET (3 elem)
#         SEQUENCE (2 elem)
#           OBJECT IDENTIFIER 2.5.4.42 givenName (X.520 DN component)
#           UTF8String ALAIN
#       SET (3 elem)
#         SEQUENCE (2 elem)
#           OBJECT IDENTIFIER 2.5.4.4 surname (X.520 DN component)
#           UTF8String DUBOIS RPPS
#       SET (3 elem)
#         SEQUENCE (2 elem)
#           OBJECT IDENTIFIER 2.5.4.3 commonName (X.520 DN component)
#           UTF8String 389900098933

# If we look at the DN, we get this:
$subjectDN = $cert.SubjectDN
$($subjectDN)

# Chilkat produces this:
# C=FR, Title=Mdecin, G=ALAIN, SN=DUBOIS RPPS, CN=389900098933

# However, if the certificate's internal ASN.1 groups several items in a single SET,
# such as shown below, Microsoft .NET will produce a DN like this:
# G=ALAIN + SN=DUBOIS RPPS + CN=389900098933, T=Mdecin, C=FR

# Notice how the items in the SET are grouped with " + ".
# Also notice the order is reverse, and "T" is used instead of using "Title.
# These are all variations of how a DN might be formatted.
# In practice, there is no correct way because what is needed depends on what is
# required as input to whatever is receiving the DN.

# SEQUENCE (3 elem)
#       SET (1 elem)
#         SEQUENCE (2 elem)
#           OBJECT IDENTIFIER 2.5.4.6 countryName (X.520 DN component)
#           PrintableString FR
#       SET (1 elem)
#         SEQUENCE (2 elem)
#           OBJECT IDENTIFIER 2.5.4.12 title (X.520 DN component)
#           UTF8String Mdecin
#       SET (3 elem)
#         SEQUENCE (2 elem)
#           OBJECT IDENTIFIER 2.5.4.42 givenName (X.520 DN component)
#           UTF8String ALAIN
#         SEQUENCE (2 elem)
#           OBJECT IDENTIFIER 2.5.4.4 surname (X.520 DN component)
#           UTF8String DUBOIS RPPS
#         SEQUENCE (2 elem)
#           OBJECT IDENTIFIER 2.5.4.3 commonName (X.520 DN component)
#           UTF8String 389900098933

# To ensure Chilkat produces the same DN format as .NET, you can specify
# the keyword "DotNetSimpleName" in the UncommonOptions.
# For example:

$cert.UncommonOptions = "DotNetSimpleName"

# If the above option is used (which was added in Chilkat v9.5.0.96), then Chilkat
# will produce the DN in the same format as .NET

$subjectDN = $cert.SubjectDN
$($subjectDN)

# Now Chilkat produces this:
# G=ALAIN + SN=DUBOIS RPPS + CN=389900098933, T=Mdecin, C=FR