diff --git a/app/models/x509_certificate_request.rb b/app/models/x509_certificate_request.rb
new file mode 100644
index 0000000..17a74d7
--- /dev/null
+++ b/app/models/x509_certificate_request.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class X509CertificateRequest < ApplicationRecord
+  ################
+  # Associations #
+  ################
+
+  belongs_to :rsa_public_key
+
+  ###############
+  # Validations #
+  ###############
+
+  validates :distinguished_name,
+            presence: true,
+            length: { maximum: 10_000 }
+end
diff --git a/db/migrate/20190910133430_create_x509_certificate_requests.rb b/db/migrate/20190910133430_create_x509_certificate_requests.rb
new file mode 100644
index 0000000..9bf4111
--- /dev/null
+++ b/db/migrate/20190910133430_create_x509_certificate_requests.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+class CreateX509CertificateRequests < ActiveRecord::Migration[6.0]
+  include Partynest::Migration
+
+  def change
+    create_table :x509_certificate_requests do |t|
+      t.timestamps null: false
+
+      t.references :rsa_public_key, null: false, foreign_key: true
+
+      t.string :distinguished_name, null: false
+    end
+
+    constraint :x509_certificate_requests, :distinguished_name, <<~SQL
+      is_good_big_text(distinguished_name)
+    SQL
+  end
+end
diff --git a/db/structure.sql b/db/structure.sql
index 14b4dde..41f4b3c 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -881,6 +881,39 @@ CREATE SEQUENCE public.users_id_seq
 ALTER SEQUENCE public.users_id_seq OWNED BY public.users.id;
 
 
+--
+-- Name: x509_certificate_requests; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE TABLE public.x509_certificate_requests (
+    id bigint NOT NULL,
+    created_at timestamp(6) without time zone NOT NULL,
+    updated_at timestamp(6) without time zone NOT NULL,
+    rsa_public_key_id bigint NOT NULL,
+    distinguished_name character varying NOT NULL,
+    CONSTRAINT distinguished_name CHECK (public.is_good_big_text((distinguished_name)::text))
+);
+
+
+--
+-- Name: x509_certificate_requests_id_seq; Type: SEQUENCE; Schema: public; Owner: -
+--
+
+CREATE SEQUENCE public.x509_certificate_requests_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+
+--
+-- Name: x509_certificate_requests_id_seq; Type: SEQUENCE OWNED BY; Schema: public; Owner: -
+--
+
+ALTER SEQUENCE public.x509_certificate_requests_id_seq OWNED BY public.x509_certificate_requests.id;
+
+
 --
 -- Name: accounts id; Type: DEFAULT; Schema: public; Owner: -
 --
@@ -993,6 +1026,13 @@ ALTER TABLE ONLY public.user_omniauths ALTER COLUMN id SET DEFAULT nextval('publ
 ALTER TABLE ONLY public.users ALTER COLUMN id SET DEFAULT nextval('public.users_id_seq'::regclass);
 
 
+--
+-- Name: x509_certificate_requests id; Type: DEFAULT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.x509_certificate_requests ALTER COLUMN id SET DEFAULT nextval('public.x509_certificate_requests_id_seq'::regclass);
+
+
 --
 -- Name: accounts accounts_pkey; Type: CONSTRAINT; Schema: public; Owner: -
 --
@@ -1137,6 +1177,14 @@ ALTER TABLE ONLY public.users
     ADD CONSTRAINT users_pkey PRIMARY KEY (id);
 
 
+--
+-- Name: x509_certificate_requests x509_certificate_requests_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.x509_certificate_requests
+    ADD CONSTRAINT x509_certificate_requests_pkey PRIMARY KEY (id);
+
+
 --
 -- Name: index_accounts_on_contact_list_id; Type: INDEX; Schema: public; Owner: -
 --
@@ -1417,6 +1465,13 @@ CREATE UNIQUE INDEX index_users_on_reset_password_token ON public.users USING bt
 CREATE UNIQUE INDEX index_users_on_unlock_token ON public.users USING btree (unlock_token);
 
 
+--
+-- Name: index_x509_certificate_requests_on_rsa_public_key_id; Type: INDEX; Schema: public; Owner: -
+--
+
+CREATE INDEX index_x509_certificate_requests_on_rsa_public_key_id ON public.x509_certificate_requests USING btree (rsa_public_key_id);
+
+
 --
 -- Name: accounts ensure_contact_list_id_matches_related_person; Type: TRIGGER; Schema: public; Owner: -
 --
@@ -1566,6 +1621,14 @@ ALTER TABLE ONLY public.contacts
     ADD CONSTRAINT fk_rails_dd2a5400cf FOREIGN KEY (contact_list_id) REFERENCES public.contact_lists(id);
 
 
+--
+-- Name: x509_certificate_requests fk_rails_f0002b108f; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.x509_certificate_requests
+    ADD CONSTRAINT fk_rails_f0002b108f FOREIGN KEY (rsa_public_key_id) REFERENCES public.rsa_public_keys(id);
+
+
 --
 -- PostgreSQL database dump complete
 --
@@ -1576,6 +1639,7 @@ INSERT INTO "schema_migrations" (version) VALUES
 ('20181129203927'),
 ('20181130024918'),
 ('20190910040709'),
-('20190910115511');
+('20190910115511'),
+('20190910133430');
 
 
diff --git a/factories/x509_certificate_requests.rb b/factories/x509_certificate_requests.rb
new file mode 100644
index 0000000..84b3b04
--- /dev/null
+++ b/factories/x509_certificate_requests.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :x509_certificate_request do
+    association :rsa_public_key
+
+    distinguished_name { "CN=#{Faker::Internet.domain_name}" }
+  end
+end
diff --git a/spec/models/x509_certificate_request_spec.rb b/spec/models/x509_certificate_request_spec.rb
new file mode 100644
index 0000000..d77ec37
--- /dev/null
+++ b/spec/models/x509_certificate_request_spec.rb
@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe X509CertificateRequest do
+  subject { create :x509_certificate_request }
+
+  describe '#rsa_public_key' do
+    it do
+      is_expected.to \
+        validate_presence_of(:rsa_public_key).with_message(:required)
+    end
+  end
+
+  describe '#distinguished_name' do
+    it { is_expected.to validate_presence_of :distinguished_name }
+
+    it do
+      is_expected.to validate_length_of(:distinguished_name).is_at_most(10_000)
+    end
+  end
+end