diff --git a/src/ca-module.cpp b/src/ca-module.cpp
index c9a52c7..5a16ab3 100644
--- a/src/ca-module.cpp
+++ b/src/ca-module.cpp
@@ -39,7 +39,6 @@
 namespace ndn {
 namespace ndncert {
 
-static const int IS_SUBNAME_MIN_OFFSET = 5;
 static const time::seconds DEFAULT_DATA_FRESHNESS_PERIOD = 1_s;
 static const time::seconds REQUEST_VALIDITY_PERIOD_NOT_BEFORE_GRACE_PERIOD = 120_s;
 
@@ -305,9 +304,8 @@
     // verify the self-signed certificate, the request, and the token
     if (!m_config.m_caPrefix.isPrefixOf(clientCert->getName()) // under ca prefix
         || !security::v2::Certificate::isValidName(clientCert->getName()) // is valid cert name
-        || clientCert->getName().size() < m_config.m_caPrefix.size() + IS_SUBNAME_MIN_OFFSET
-        || clientCert->getName().size() >
-                m_config.m_caPrefix.size() + IS_SUBNAME_MIN_OFFSET - 1 + m_config.m_maxSuffixLength) {
+        || clientCert->getIdentity().size() <= m_config.m_caPrefix.size()
+        || clientCert->getIdentity().size() > m_config.m_caPrefix.size() + m_config.m_maxSuffixLength) {
       _LOG_ERROR("Invalid self-signed certificate name " << clientCert->getName());
       return;
     }
@@ -337,9 +335,8 @@
     // verify the certificate
     if (!m_config.m_caPrefix.isPrefixOf(clientCert->getName()) // under ca prefix
         || !security::v2::Certificate::isValidName(clientCert->getName()) // is valid cert name
-        || clientCert->getName().size() < m_config.m_caPrefix.size() + IS_SUBNAME_MIN_OFFSET
-        || clientCert->getName().size() >
-                m_config.m_caPrefix.size() + IS_SUBNAME_MIN_OFFSET - 1 + m_config.m_maxSuffixLength) {
+        || clientCert->getIdentity().size() <= m_config.m_caPrefix.size()
+        || clientCert->getIdentity().size() > m_config.m_caPrefix.size() + m_config.m_maxSuffixLength) {
       _LOG_ERROR("Invalid certificate name " << clientCert->getName());
       return;
     }