Apparently you can put 'or' keyword in the profile like this: ... and (certificate leaf[subject.OU] = "X"; or certificate leaf[subject.OU] = "Y")