Parsing the CN out of a certificate DN [duplicate]

Answer 1

You can use Spring Frameworks LdapUtils to extract CN in a neat way like below :

String cn = LdapUtils.getStringValue(new LdapName(group),"cn");

OR

Without using Spring Framework like below :

String cn = (String)new LdapName(group).getRdns().stream().filter(rdn -> rdn.getType().equalsIgnoreCase("CN")).findFirst().get().getValue();

Answer 2

You can avoid using a 'crappy' expression. If you already have the DN, you can split the String and then find the CN. For example:

String dn = "CN=Jimmy Blooptoop,OU=Someplace,OU=Employees,DC=Bloopsoft-Inc";
String[] split = dn.split(","); 
for (String x : split) {
    if (x.contains("CN=")) {
        System.out.println(x.trim());
    }
}

Answer 3

Looks like this works OK

CertificateFactory fact = CertificateFactory.getInstance("X.509");
FileInputStream is = new FileInputStream ("cert.pem");
X509Certificate cert = (X509Certificate) fact.generateCertificate(is);
String cn = ((X500Name)cert.getSubjectDN()).getCommonName()

Answer 4

If you are using Spring Framework, you may use DistinguishedName as follow:

String path = "CN=Jimmy Blooptoop,OU=Someplace,OU=Employees,DC=Bloopsoft-Inc";
DistinguishedName dn = new DistinguishedName(path);

String cn = dn.getValue("cn"); // Jimmy Blooptoop

Answer 5

How about javax.naming.ldap.LdapName?

String dn = "CN=Jimmy Blooptoop,OU=Someplace,OU=Employees,DC=Bloopsoft-Inc";
LdapName ln = new LdapName(dn);

for(Rdn rdn : ln.getRdns()) {
    if(rdn.getType().equalsIgnoreCase("CN")) {
        System.err.println("CN is: " + rdn.getValue());
        break;
    }
}

It's not the most beautiful interface since there is something missing like LdapName#getByType(String) but it saves you the trouble of having to think about what strange features DNs might have.

Answer 6

You should not be using regular expressions offered above. The problem with those regular expressions is that you will not follow RFC 4514 and will not unescape previously escaped symbols and may potentially loose or misinterpret a distinguished name. Use LdapName class instead as recommended by musiKk to parse a distinguished name correctly.