Certificate subject X.509

问题:

According to the X.509, a certificate has an attribute subject.

C=US, ST=Maryland, L=Pasadena, O=Brent Baccala, OU=FreeSoft,
CN=www.freesoft.org/emailAddress=[e-mail]

This is the typical subject value. The question is what are the types(or tags) of those attributes(C, ST, L, O, OU, CN) and what is their format?

回答1:

IETF PKIX (latest version RFC 5280) is a well accepted profile for certificates. From section 4.1.2.4, the following fields must be supported (I've added between parenthesis is the OpenSSL long and optional short name):

• country (countryName, C),
• organization (organizationName, O),
• organizational unit (organizationalUnitName, OU),
• distinguished name qualifier (dnQualifier),
• state or province name (stateOrProvinceName, ST),
• common name (commonName, CN) and
• serial number (serialNumber).

There's also a list of element that should be supported:

• locality (locality, L),
• title (title),
• surname (surName, SN),
• given name (givenName, GN),
• initials (initials),
• pseudonym (pseudonym) and
• generation qualifier (generationQualifier).

Values should be encoded in UTF8String or PrintableString (some of them only in PrintableString, and some exceptions in IA5String). The standard also has a maximum length for all field types (Appendix A.1)

For reasons of compatibility, implementations must also support domain components (domainComponent, DC) encoded in IA5String. Attention is drawn to email (emailAddress) and its encoding (IA5String, but it's considered deprecated in DNs (it should be in Subject Alternative Name extension).