Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the X.509 specification it sais that the issuer name is to be signed.

Since we verify the certificate with the authenticated issuer's public key, it seems infeasible to forge the issuer name anyways. A different issuer name would lead us to choose a different entities public key which would never match the signature.

Could somebody please shed some light on this for me?

share|improve this question
What would you gain by omitting it? – CodesInChaos Aug 14 '13 at 15:11
I do like these types of questions; they are useful for ferreting out bugs. e.g. software shouldn't rely too heavily on the issuer name. – LamonteCristo Aug 14 '13 at 15:34
@CodesInChaos It is not so much what you would gain by going back, but rather why it was designed that way in the first place. I am learning about IT Security at the moment an was thaught to be very precise about the goals I want to achieve with crypto in a protocol. Since I could not find a reason behind including the issuer name in the part which is signed in X.509, I thought, well, maybe I missed sth. and sb. else knows.. – Karl Hardr Aug 14 '13 at 15:44
up vote 4 down vote accepted

Everything in a certificate is signed. It is much simpler to sign the whole lot than to sign only parts of it; skipping the issuer name would not gain much anyway (the hashing part of the signature is really fast).

We can imagine a sort-of-X.509 with the issuer name being excluded from the signature; it does not seem, at first glance, to be terribly weaker, but this would deserve a lot of serious investigation to be sure of it. Since there is very little gain in excluding the issuer name from the signature, the exercise would be rather pointless.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.