Certificate subject X.509

Question

According to the X.509, a certificate has an attribute subject.

C=US, ST=Maryland, L=Pasadena, O=Brent Baccala, OU=FreeSoft,
CN=www.freesoft.org/emailAddress=bac         


        

Answer 1

IETF PKIX (latest version RFC 5280) is a well accepted profile for certificates. From section 4.1.2.4, the following fields must be supported (I've added between parenthesis is the OpenSSL long and optional short name):

• country (countryName, C),
• organization (organizationName, O),
• organizational unit (organizationalUnitName, OU),
• distinguished name qualifier (dnQualifier),
• state or province name (stateOrProvinceName, ST),
• common name (commonName, CN) and
• serial number (serialNumber).

There's also a list of element that should be supported:

• locality (locality, L),
• title (title),
• surname (surName, SN),
• given name (givenName, GN),
• initials (initials),
• pseudonym (pseudonym) and
• generation qualifier (generationQualifier).

Values should be encoded in UTF8String or PrintableString (some of them only in PrintableString, and some exceptions in IA5String). The standard also has a maximum length for all field types (Appendix A.1)

For reasons of compatibility, implementations must also support domain components (domainComponent, DC) encoded in IA5String. Attention is drawn to email (emailAddress) and its encoding (IA5String, but it's considered deprecated in DNs (it should be in Subject Alternative Name extension).