diff --git a/packages/system-test/src/main/bin/populate b/packages/system-test/src/main/bin/populate
index c98fb411bd7..aa155a02a98 100755
--- a/packages/system-test/src/main/bin/populate
+++ b/packages/system-test/src/main/bin/populate
@@ -18,6 +18,10 @@ lib="$(getProperty dcache.paths.share.lib)"
 
 cd @TARGET@/dcache
 
+extract_dn() {
+  openssl x509 -in $1 -noout -subject -nameopt compat | sed -E -e 's:subject= */?:/:;s:, :/:g;s: = :=:g'
+}
+
 build_ca() {
     local host_cert_hash old_dn ca_key ca_cert ca_index trust_store ca_serial
 
@@ -134,7 +138,8 @@ EOF
     host_cert_hash=$(openssl x509 -in $ca_cert -noout -subject_hash)
     cp "$ca_cert" "$trust_store/$host_cert_hash.0"
 
-    old_dn="$(openssl x509 -in $ca_cert -noout -subject -nameopt compat | sed 's:subject= *\+/\?:/:;s:, :/:g')"
+    old_dn=$(extract_dn "$ca_cert")
+
     cat > "$trust_store/$host_cert_hash.signing_policy" <<EOF
 access_id_CA    X509    '$old_dn'
 pos_rights      globus  CA:sign
@@ -278,7 +283,7 @@ add_dn_from_file() { # $1 - X.509 pem certificate
 	return
     fi
 
-    dn=$(openssl x509 -in "$1" -subject -noout -nameopt compat | sed 's:subject= *\+/\?:/:;s:, :/:g')
+    dn=$(extract_dn "$1")
 
     rc=0
     bin/dcache kpwd dcuserlist "$username" | grep -q "Authentication Record" || rc=$?