---
title: Resolve SAIF certificate DN
summary: Builds the distinguished name string for the SAIF (non-admin) authentication certificate from configuration.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-07-30
library: SAIF.Services.WebServices.Epay
reference_type: package
operation_id: OP-EPAY-02
trigger: Caller invokes USBank.GetSAIFCertDistinguishedName()
---

# Resolve SAIF certificate DN

This operation composes the distinguished name (DN) string for the SAIF (non-admin) authentication certificate from configuration-supplied name parts. It is the public counterpart to the DN-resolution logic embedded in [Generate SSO handshake payload](generate-sso-handshake-payload.md), but resolves a different configuration key and certificate than the SSO handshake uses.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-EPAY-02 |
| **Trigger** | Caller invokes `USBank.GetSAIFCertDistinguishedName()` |
| **Inputs** | None |
| **Outputs** | DN string (String) |
| **Primary components** | `USBank.GetSAIFCertDistinguishedName`, `USBank.GetCertificateParameters` |
| **Entry point** | `Services\SAIF.Services.WebServices.Epay\WebService\USBank.vb` |

## Steps

1. Call `GetCertificateParameters("usBankEPayAuthenticationCertDN")`.
2. `GetCertificateParameters` reads the `usBankEPayAuthenticationCertDN` configuration setting via `AppGlobal.EnvironmentService.GetConfigSetting` and JSON-deserializes the result (`JavaScriptSerializer.Deserialize`) into a dictionary of DN key/value pairs ([BR-003](../business-rules.md#br-003-certificate-dn-composition-is-externally-configurable)).
3. Pass the key/value pairs to `SAIFCrypto.Certificates.GetDistinguishedName` to build the DN string.
4. Return the DN string to the caller.

The Friend-scoped `LoadSAIFCert` helper can subsequently load the certificate itself from `LocalMachine\My` using this DN, but it is not invoked by [Generate SSO handshake payload](generate-sso-handshake-payload.md) (`GetSSOData`) in the current code — `GetSSOData` resolves and loads a separate certificate (the SAIF *admin* authentication certificate, via `usBankEPayAuthenticationAdminCertDN`) instead.* No other caller of `GetSAIFCertDistinguishedName` or `LoadSAIFCert` was found in this library.**

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([Start: GetSAIFCertDistinguishedName]) --> Config[Read usBankEPayAuthenticationCertDN<br>config setting]
	Config --> Deserialize[JSON-deserialize into<br>DN key/value pairs]
	Deserialize --> BuildDN[Build DN string via<br>SAIFCrypto.Certificates.GetDistinguishedName]
	BuildDN --> End([Return DN string])
```

## Failure and edge-case behavior

- If the `usBankEPayAuthenticationCertDN` configuration key is missing or its value is malformed JSON, `JavaScriptSerializer.Deserialize` throws inside `GetCertificateParameters`, and no DN string is returned.
- This operation only builds the DN string; it does not load the certificate from the certificate store itself. The Friend-scoped `LoadSAIFCert` helper performs the load using this DN, but is not called from `GetSSOData` in the current code, so this operation's output has no confirmed active consumer within this library.*

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with `**` could not be confirmed; treat as unknown until verified.

## Sources
- `Services\SAIF.Services.WebServices.Epay\WebService\USBank.vb`