diff --git a/configure.ac b/configure.ac
index d35b1008..45125297 100644
--- a/configure.ac
+++ b/configure.ac
@@ -772,6 +772,8 @@ if ! ${configure_dist_target_only:-false} ; then
 	AC_CHECK_HEADER(ldap.h,,AC_MSG_ERROR(ldap.h not found))
 	AC_CHECK_FUNC(ldap_initialize,,AC_CHECK_LIB(ldap,ldap_initialize))
 	AC_CHECK_FUNC(ldap_sasl_interactive_bind_s,,AC_CHECK_LIB(ldap,ldap_sasl_interactive_bind_s))
+	AC_CHECK_FUNC(ldap_str2dn,,AC_CHECK_LIB(ldap,ldap_str2dn))
+	AC_CHECK_FUNC(ldap_dnfree,,AC_CHECK_LIB(ldap,ldap_dnfree))
 	LDAP_CFLAGS="$CFLAGS"
 	LDAP_LIBS="$LIBS"
 	CFLAGS="$CFLAGSsave"
diff --git a/src/Makefile.am b/src/Makefile.am
index c8713472..fe3b2351 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -150,7 +150,7 @@ pkglibexecdir = $(libexecdir)/$(PACKAGE)
 getcert_CFLAGS = $(AM_CFLAGS) $(NSS_CFLAGS) $(UUID_CFLAGS)
 getcert_SOURCES = getcert.c tm.c tm.h
 getcert_LDADD = libcm.a $(GETCERT_LIBS) $(KRB5_LIBS) $(NSS_LIBS) $(UUID_LIBS) \
-			$(POPT_LIBS) $(LTLIBICONV)
+			$(POPT_LIBS) $(LTLIBICONV) $(LDAP_LIBS)
 if WITH_IPA
 bin_PROGRAMS += ipa-getcert
 ipa_getcert_CFLAGS = $(getcert_CFLAGS)
@@ -176,16 +176,16 @@ certmonger_getcert_CFLAGS = $(getcert_CFLAGS)
 certmonger_SOURCES = main.c env-system.c tm.c tm.h
 certmonger_LDADD = libcm.a \
 		   $(OPENSSL_LIBS) $(CERTMONGER_LIBS) $(KRB5_LIBS) $(IDN_LIBS) \
-		   $(GMP_LIBS) $(UUID_LIBS) $(POPT_LIBS) $(LTLIBICONV)
+		   $(GMP_LIBS) $(UUID_LIBS) $(POPT_LIBS) $(LTLIBICONV) $(LDAP_LIBS)
 certmonger_session_SOURCES = main.c env-session.c tm.c tm.h
 certmonger_session_LDADD = libcm.a \
 		   $(OPENSSL_LIBS) $(CERTMONGER_LIBS) $(KRB5_LIBS) $(IDN_LIBS) \
-		   $(GMP_LIBS) $(UUID_LIBS) $(POPT_LIBS) $(LTLIBICONV)
+		   $(GMP_LIBS) $(UUID_LIBS) $(POPT_LIBS) $(LTLIBICONV) $(LDAP_LIBS)
 noinst_PROGRAMS = tdbusm-check serial-check nl-check submit-x toklist
 tdbusm_check_SOURCES = tdbusm-check.c tm.c tm.h
-tdbusm_check_LDADD = libcm.a $(CERTMONGER_LIBS) $(POPT_LIBS)
-serial_check_LDADD = libcm.a $(CERTMONGER_LIBS) $(LTLIBICONV)
-nl_check_LDADD = libcm.a $(CERTMONGER_LIBS)
+tdbusm_check_LDADD = libcm.a $(CERTMONGER_LIBS) $(POPT_LIBS) $(LDAP_LIBS)
+serial_check_LDADD = libcm.a $(CERTMONGER_LIBS) $(LTLIBICONV) $(LDAP_LIBS)
+nl_check_LDADD = libcm.a $(CERTMONGER_LIBS) $(LDAP_LIBS)
 submit_x_CFLAGS = $(AM_CFLAGS) $(NSS_CFLAGS) -DCM_SUBMIT_X_MAIN
 submit_x_SOURCES = submit-x.c submit-x.h submit-u.c submit-u.h log.c log.h \
 	tm.c tm.h
diff --git a/src/csrgen-o.c b/src/csrgen-o.c
index 55b0a598..b3f37756 100644
--- a/src/csrgen-o.c
+++ b/src/csrgen-o.c
@@ -34,6 +34,8 @@
 #include <openssl/err.h>
 #include <openssl/pem.h>
 
+#include <ldap.h>
+
 #include <talloc.h>
 
 #include "certext.h"
@@ -92,7 +94,10 @@ cm_csrgen_o_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
 	NETSCAPE_SPKAC spkac;
 	EVP_PKEY *pkey;
 	BIGNUM *serialbn;
-	char buf[LINE_MAX], *p, *q, *s, *nickname, *pin, *password, *filename;
+	char buf[LINE_MAX], *s, *nickname, *pin, *password, *filename;
+	LDAPDN dn = NULL;
+	LDAPRDN rdn = NULL;
+	LDAPAVA *attr = NULL;
 	unsigned char *extensions, *upassword, *bmp, *name, *up, *uq, md[CM_DIGEST_MAX];
 	char *spkidec, *mcb64, *nows;
 	const char *default_cn = CM_DEFAULT_CERT_SUBJECT_CN, *spkihex = NULL;
@@ -193,33 +198,28 @@ cm_csrgen_o_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
 			if ((subject == NULL) &&
 			    (entry->cm_template_subject != NULL) &&
 			    (strlen(entry->cm_template_subject) != 0)) {
-				/* This isn't really correct, but it will
-				 * probably do for now. */
-				p = entry->cm_template_subject;
-				q = p + strcspn(p, ",");
+				int ret;
 				subject = X509_NAME_new();
 				if (subject != NULL) {
-					while (*p != '\0') {
-						if ((s = memchr(p, '=', q - p)) != NULL) {
-							*s = '\0';
-							for (i = 0; p[i] != '\0'; i++) {
-								p[i] = toupper(p[i]);
-							}
-							X509_NAME_add_entry_by_txt(subject,
-										   p, astring_type(p, s + 1, q - s - 1),
-										   (unsigned char *) (s + 1), q - s - 1,
-										   -1, 0);
-							*s = '=';
-						} else {
+					ret = ldap_str2dn(entry->cm_template_subject, &dn, LDAP_DN_FORMAT_LDAPV3);
+					if (ret == LDAP_SUCCESS) {
+						for (i = 0; dn[i] != NULL; i++) {
+							rdn = dn[i];
+
+							attr = rdn[0];
 							X509_NAME_add_entry_by_txt(subject,
-										   "CN", astring_type("CN", p, q - p),
-										   (unsigned char *) p, q - p,
+										   attr->la_attr.bv_val, astring_type(attr->la_attr.bv_val, attr->la_value.bv_val, attr->la_value.bv_len),
+										   (unsigned char *) attr->la_value.bv_val, attr->la_value.bv_len,
 										   -1, 0);
 						}
-						p = q + strspn(q, ",");
-						q = p + strcspn(p, ",");
+						if (dn != NULL)
+							ldap_dnfree(dn);
+					} else {
+						X509_NAME_add_entry_by_txt(subject,
+							"CN", astring_type("CN", entry->cm_template_subject, -1),
+							(unsigned char *) entry->cm_template_subject, -1, -1, 0);
+					}
 					}
-				}
 			}
 			if (subject == NULL) {
 				subject = X509_NAME_new();
diff --git a/tests/tools/Makefile.am b/tests/tools/Makefile.am
index b2c42ce3..39fa9543 100644
--- a/tests/tools/Makefile.am
+++ b/tests/tools/Makefile.am
@@ -3,7 +3,8 @@ AM_CFLAGS = $(TALLOC_CFLAGS) $(TEVENT_CFLAGS) $(DBUS_CFLAGS) $(KRB5_CFLAGS) \
 	    $(POPT_CFLAGS) -I$(top_builddir)/src -I$(top_srcdir)/src
 LDADD = libtools.a $(top_builddir)/src/libcm.a $(top_srcdir)/src/env-system.c \
 	libtools.a $(OPENSSL_LIBS) $(CERTMONGER_LIBS) $(KRB5_LIBS) $(IDN_LIBS) \
-	$(GMP_LIBS) $(UUID_LIBS) $(RESOLV_LIBS) $(POPT_LIBS) $(LTLIBICONV)
+	$(GMP_LIBS) $(UUID_LIBS) $(RESOLV_LIBS) $(POPT_LIBS) $(LTLIBICONV) \
+	$(LDAP_LIBS)
 
 noinst_SCRIPTS = cachain.sh
 
