Certificates generally associate a public key with a name, but few people talk about how useful that association is. Imagine that you receive the certificate of John Robinson. You may know only one John Robinson personally, but how many does the CA know? How do you find out if the particular John Robinson certificate you received is your friend's certificate? You could have received his public key in person or verified it in person (PGP allows this), but more likely you received a certificate in e-mail and are simply trusting that it is the correct John Robinson. The certificate's Common Name will probably be extended with some other information, in order to make it unique among names issued by that one CA.