diff --git a/pkg/services/privateca/privateca_certificate.go b/pkg/services/privateca/privateca_certificate.go
index 0db82086b6..36f97425c6 100644
--- a/pkg/services/privateca/privateca_certificate.go
+++ b/pkg/services/privateca/privateca_certificate.go
@@ -170,12 +170,6 @@ should be set to 'my-ca'.`,
 													ForceNew:    true,
 													Description: `The common name of the distinguished name.`,
 												},
-												"organization": {
-													Type:        schema.TypeString,
-													Required:    true,
-													ForceNew:    true,
-													Description: `The organization of the subject.`,
-												},
 												"country_code": {
 													Type:        schema.TypeString,
 													Optional:    true,
@@ -188,6 +182,12 @@ should be set to 'my-ca'.`,
 													ForceNew:    true,
 													Description: `The locality or city of the subject.`,
 												},
+												"organization": {
+													Type:        schema.TypeString,
+													Optional:    true,
+													ForceNew:    true,
+													Description: `The organization of the subject.`,
+												},
 												"organizational_unit": {
 													Type:        schema.TypeString,
 													Optional:    true,
diff --git a/pkg/services/privateca/privateca_certificate_cai2hcl.go b/pkg/services/privateca/privateca_certificate_cai2hcl.go
index da70685b18..8fc72a170a 100644
--- a/pkg/services/privateca/privateca_certificate_cai2hcl.go
+++ b/pkg/services/privateca/privateca_certificate_cai2hcl.go
@@ -276,11 +276,10 @@ func flattenPrivatecaCertificateConfigSubjectConfigSubjectCountryCode(v interfac
 
 func flattenPrivatecaCertificateConfigSubjectConfigSubjectOrganization(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
 	if v == nil {
-		return "unknown"
+		return nil
 	}
-	transformed := v.(string)
-	if transformed == "" {
-		return "unknown"
+	if strVal, ok := v.(string); ok && strVal == "" {
+		return nil
 	}
 	return v
 }
diff --git a/test/services/privateca/privateca_certificate_generated_test.go b/test/services/privateca/privateca_certificate_generated_test.go
index 50391a20ce..abda6e77d0 100644
--- a/test/services/privateca/privateca_certificate_generated_test.go
+++ b/test/services/privateca/privateca_certificate_generated_test.go
@@ -39,6 +39,9 @@ func TestAccPrivatecaCertificate(t *testing.T) {
 		{
 			Name: "TestAccPrivatecaCertificate_privatecaCertificateCustomSkiExample",
 		},
+		{
+			Name: "TestAccPrivatecaCertificate_privatecaCertificateSubjectConfigOrgOptionalExample",
+		},
 		{
 			Name: "TestAccPrivatecaCertificate_privatecaCertificateUpdate",
 		},