diff --git a/lib/hx509/ca.c b/lib/hx509/ca.c
index 6aa464eab..0759d441b 100644
--- a/lib/hx509/ca.c
+++ b/lib/hx509/ca.c
@@ -997,6 +997,23 @@ hx509_ca_tbs_subject_expand(hx509_context context,
     return hx509_name_expand(context, tbs->subject, env);
 }
 
+/**
+ * Get the name of a to-be-signed certificate object.
+ *
+ * @param context A hx509 context.
+ * @param tbs object to be signed.
+ *
+ * @return An hx509 name.
+ *
+ * @ingroup hx509_ca
+ */
+
+HX509_LIB_FUNCTION hx509_name HX509_LIB_CALL
+hx509_ca_tbs_get_name(hx509_ca_tbs tbs)
+{
+    return tbs->subject;
+}
+
 /**
  * Set signature algorithm on the to be signed certificate
  *
diff --git a/lib/hx509/libhx509-exports.def b/lib/hx509/libhx509-exports.def
index aaf3c5cf6..0adff2b98 100644
--- a/lib/hx509/libhx509-exports.def
+++ b/lib/hx509/libhx509-exports.def
@@ -70,6 +70,7 @@ EXPORTS
 	hx509_ca_tbs_add_san_pkinit
 	hx509_ca_tbs_add_san_rfc822name
 	hx509_ca_tbs_free
+	hx509_ca_tbs_get_name
 	hx509_ca_tbs_init
 	hx509_ca_tbs_set_ca
 	hx509_ca_tbs_set_domaincontroller
diff --git a/lib/hx509/version-script.map b/lib/hx509/version-script.map
index 737de5f57..cdccbf49a 100644
--- a/lib/hx509/version-script.map
+++ b/lib/hx509/version-script.map
@@ -50,6 +50,7 @@ HEIMDAL_X509_1.2 {
 		hx509_ca_tbs_add_san_pkinit;
 		hx509_ca_tbs_add_san_rfc822name;
 		hx509_ca_tbs_free;
+		hx509_ca_tbs_get_name;
 		hx509_ca_tbs_init;
 		hx509_ca_tbs_set_ca;
 		hx509_ca_tbs_set_domaincontroller;