Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The SPKAC ASN.1 description:

PublicKeyAndChallenge ::= SEQUENCE {
    spki SubjectPublicKeyInfo,
    challenge IA5STRING
}

SignedPublicKeyAndChallenge ::= SEQUENCE {
    publicKeyAndChallenge PublicKeyAndChallenge,
    signatureAlgorithm AlgorithmIdentifier,
    signature BIT STRING
}

A normal CSR has a section for the subjects distinguished name (DN). SPKACs don't. As such how are X.509 certs created from SPKACs? Are people presented with prompts asking them for all the DN attributes or something?

share|improve this question
add comment

1 Answer

A certificate request is "just" a token requesting that a CA issues a certificate with contents set as the CA sees fit. The CA is supposed to fill the certificate with information that it partially obtains from the requester, but also from other sources. In any case, even if a PKCS#10 request allows for specifying a complete DN, the CA is not bound to issue the certificate with exactly that DN. For instance, no sane CA will issue a certificate to me, with the DN "CN=Barack Obama,O=US Government,C=US". It may issue a certificate with a DN "CN=Thomas Pornin", but only because the CA "knows" my name by some out-of-band mechanism (e.g. the request has come through a SSL tunnel, in a session in which I was previously authenticated).

However, if the CA can verify the DN from a certificate request, then it already knows the name, and thus it does not really need the name from the request itself: the CA can put the correct name in the certificate by itself.

The SPKAC certificate request format is just an old barebone format which assumes that the CA already knows everything, except the public key. The "challenge" and the "signature" are extra security feature to prevent some attacks (e.g. the signature prevents me from requesting a certificate which contains the public key of someone else).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.