yes, it's possible; but is it also good practise (especially for bigger directories)? if you work with tree structures in your person directory (e.g. ou's and departments and so on), people objects might change there position in the tree, and so sooner or later there may be collitions with the same cn in the same ou. That is one of the reason why I prefer having a unique naming attribute value (e.g. cn=surname givenname uniqueId), another one is that you can think about saving all the person objects in one container (e.g. ou) and if a person changes department, you don't need to revoke and create certificates because the dn doesn't change...

well, deleting and creating a person object in case of a name change often is a bad idea:

• in a metadirectory, you would loose all links to other data sources you synchronize data from and to, and also loose the data, and perhaps can't write those change of surname in other data sources you synchronize and get data inconsistency
• if you delete and create a user in ActiveDirectory, it will normally loose all it's data

So a rename or move often is the better way