DNs, RDNs, AVAs, and DER coding

MTR is correct; a directory entry might have multiple values for a given
attribute, but only one value (for each attribute) can be flagged as
"distinguished" and used in an RDN.  In your example, I guess the second OU
would have to be a separate RDN.  I'm partial to using common name for that
AVA, but then the name subordination requirement would make the full DN look
a little strange (with a CN stuck in the middle).

/ Rich