Parsing the CN out of a certificate DN

Question

Let me begin by stating that this is a question of aesthetics. I've solved my own problem, I'm just curious about better ways of doing it.

So, I've got a certificate DN, something like this:

CN=Jimmy Blooptoop,OU=Someplace,OU=Employees,DC=Bloopsoft-Inc

Now, I want to grab the CN out of that. In java, there isn't native support to grab anything but the full DN from the X509 certificate without using some 3rd party library like bouncy castle - which I can't use. So I've got to parse it out, which isn't much of problem. The only thing that makes it slightly tricky is the fact that the CN isn't always going to be formatted as <first name> <last name>. More often than not, it's actually going to be <last name>, <first name> <middle initial>. So, in the example above, the CN could be Jimmy Blooptoop or Blooptoop, Jimmy J (short for the Joop of course).

After going and reading up about about regular expressions, I wrote the following, which works well enough:

Matcher m = Pattern.compile("CN=[A-Za-z]*[, ]*[ A-Za-z]*").matcher(dn);
if (m.find())
  cn = m.group();

I'm just curious if there are expressions that would look less like crap. I'm fairly confident that there are since I worked that out after reading just an introduction to regex.

Answer 1

How about javax.naming.ldap.LdapName?

String dn = "CN=Jimmy Blooptoop,OU=Someplace,OU=Employees,DC=Bloopsoft-Inc";
LdapName ln = new LdapName(dn);

for(Rdn rdn : ln.getRdns()) {
    if(rdn.getType().equalsIgnoreCase("CN")) {
        System.err.println("CN is: " + rdn.getValue());
        break;
    }
}

It's not the most beautiful interface since there is something missing like LdapName#getByType(String) but it saves you the trouble of having to think about what strange features DNs might have.

Answer 2

You can use Spring Frameworks LdapUtils to extract CN in a neat way like below :

String cn = LdapUtils.getStringValue(new LdapName(group),"cn");

OR

Without using Spring Framework like below :

String cn = (String)new LdapName(group).getRdns().stream().filter(rdn -> rdn.getType().equalsIgnoreCase("CN")).findFirst().get().getValue();

Answer 3

Looks like this works OK

CertificateFactory fact = CertificateFactory.getInstance("X.509");
FileInputStream is = new FileInputStream ("cert.pem");
X509Certificate cert = (X509Certificate) fact.generateCertificate(is);
String cn = ((X500Name)cert.getSubjectDN()).getCommonName()

Answer 4

You can avoid using a 'crappy' expression. If you already have the DN, you can split the String and then find the CN. For example:

String dn = "CN=Jimmy Blooptoop,OU=Someplace,OU=Employees,DC=Bloopsoft-Inc";
String[] split = dn.split(","); 
for (String x : split) {
    if (x.contains("CN=")) {
        System.out.println(x.trim());
    }
}

Answer 5

If you are using Spring Framework, you may use DistinguishedName as follow:

String path = "CN=Jimmy Blooptoop,OU=Someplace,OU=Employees,DC=Bloopsoft-Inc";
DistinguishedName dn = new DistinguishedName(path);

String cn = dn.getValue("cn"); // Jimmy Blooptoop

Answer 6

You should not be using regular expressions offered above. The problem with those regular expressions is that you will not follow RFC 4514 and will not unescape previously escaped symbols and may potentially loose or misinterpret a distinguished name. Use LdapName class instead as recommended by musiKk to parse a distinguished name correctly.

Answer 7

I parse a DN like this. You get all attributes as properties:

Principal principal = cert.getSubjectDN();
Properties prop = new Properties();
prop.load(new StringReader(principal.getName().replaceAll(",", "\n")));
prop.list(System.out);
String CN= props.get("CN");

It does not work for duplicate elements like ou or dc though.

Answer 8

Regex expressions, are rather expensive to use. For such a simple task it will probably be an over kill. Instead you could use a simple String split:

String dn = ((X509Certificate) certificate).getIssuerDN().getName();
String CN = getValByAttributeTypeFromIssuerDN(dn,"CN=");

private String getValByAttributeTypeFromIssuerDN(String dn, String attributeType)
{
    String[] dnSplits = dn.split(","); 
    for (String dnSplit : dnSplits) 
    {
        if (dnSplit.contains(attributeType)) 
        {
            String[] cnSplits = dnSplit.trim().split("=");
            if(cnSplits[1]!= null)
            {
                return cnSplits[1].trim();
            }
        }
    }
    return "";
}

Answer 9

If I understood it correctly this should produce the same result, just looks a bit more readable. \w matches any word-character.

"CN=[\\w]*[., ]+[\\w ]*"

If you want something more flexible you can do this:

Matcher m = Pattern.compile("(CN=.*?),[A-Z]{2}=").matcher(dn);
if (m.find())
  cn = m.group(1);

That matches anything between "CN=" and ",XX=", where XX are two uppercase letters. group(1) returns the first group (the match inside the parentheses).

Regexp's aren't as difficult as they look !