diff --git a/mmv1/products/privateca/Certificate.yaml b/mmv1/products/privateca/Certificate.yaml
index db17114c2b9f..7d5d80cd7429 100644
--- a/mmv1/products/privateca/Certificate.yaml
+++ b/mmv1/products/privateca/Certificate.yaml
@@ -87,6 +87,15 @@ samples:
           ca_pool_id: my-pool
         test_env_vars:
           project: PROJECT_NAME
+  - name: privateca_certificate_subject_config_org_optional
+    primary_resource_id: default
+    steps:
+      - name: privateca_certificate_subject_config_org_optional
+        resource_id_vars:
+          certificate_name: my-certificate
+          ca_pool_id: my-pool
+        test_env_vars:
+          project: PROJECT_NAME
 parameters:
   - name: location
     type: String
@@ -1026,7 +1035,6 @@ properties:
               - name: organization
                 type: String
                 description: The organization of the subject.
-                required: true
                 immutable: true
               - name: organizationalUnit
                 type: String
diff --git a/mmv1/templates/terraform/samples/services/privateca/privateca_certificate_subject_config_org_optional.tf.tmpl b/mmv1/templates/terraform/samples/services/privateca/privateca_certificate_subject_config_org_optional.tf.tmpl
new file mode 100644
index 000000000000..8fa0ec70f102
--- /dev/null
+++ b/mmv1/templates/terraform/samples/services/privateca/privateca_certificate_subject_config_org_optional.tf.tmpl
@@ -0,0 +1,80 @@
+resource "google_privateca_ca_pool" "default" {
+  location = "us-central1"
+  name = "{{index $.ResourceIdVars "ca_pool_id"}}"
+  tier = "ENTERPRISE"
+}
+
+resource "google_privateca_certificate_authority" "default" {
+  location = "us-central1"
+  pool = google_privateca_ca_pool.default.name
+  certificate_authority_id = "my-authority"
+  config {
+    subject_config {
+      subject {
+        common_name = "my-certificate-authority"
+      }
+      subject_alt_name {
+        dns_names = ["hashicorp.com"]
+      }
+    }
+    x509_config {
+      ca_options {
+        is_ca = true
+      }
+      key_usage {
+        base_key_usage {
+          digital_signature = true
+          cert_sign = true
+          crl_sign = true
+        }
+        extended_key_usage {
+          server_auth = true
+        }
+      }
+    }
+  }
+  lifetime = "86400s"
+  key_spec {
+    algorithm = "RSA_PKCS1_4096_SHA256"
+  }
+
+  // Disable CA deletion related safe checks for easier cleanup.
+  deletion_protection                    = false
+  skip_grace_period                      = true
+  ignore_active_certificates_on_deletion = true
+}
+
+
+resource "google_privateca_certificate" "{{$.PrimaryResourceId}}" {
+  location = "us-central1"
+  pool = google_privateca_ca_pool.default.name
+  name = "{{index $.ResourceIdVars "certificate_name"}}"
+  lifetime = "860s"
+  config {
+    subject_config  {
+      subject {
+        common_name = "san1.example.com"
+      }
+    }
+    x509_config {
+      ca_options {
+        is_ca = false
+      }
+      key_usage {
+        base_key_usage {
+          crl_sign = true
+        }
+        extended_key_usage {
+          server_auth = true
+        }
+      }
+    }
+    public_key {
+      format = "PEM"
+      key = filebase64("test-fixtures/rsa_public.pem")
+    }
+  }
+  // Certificates require an authority to exist in the pool, though they don't
+  // need to be explicitly connected to it
+  depends_on = [google_privateca_certificate_authority.default]
+}