0

I have few questions related to DN in SSL Certificates,

  1. Can multiple domains have SSL certificates with the same DN issued by same CA?

  2. Is it ok for a single domain to have multiple SSL certificates with same DN and validity?

  3. Can we include CA related information (serial number, name or id etc) in the attribute of SSL certificate DN? e.g. cn=user001,ou=SSL,ou=001,o=DS,c=US. If it is possible then which attribute is better to use for this purpose ou, sn or other? The problem is that currently, our CA does not support multiple certificates with same DN therefore, we want to include some unique information in each SSL certificate's DN.

If possible please provide name or link to the RFC / standard for further guidance.

Thank you

1

Can multiple domains have SSL certificates with the same DN issued by same CA?

Yes. The browser does not care how many certificates are there for a site as long as these are valid, which includes that the subject(s) of the certificate match the domain name. Thus, if multiple domains should use a certificate with the same subject(s) then the subject(s) must cover all these domains, for example by using a wildcard or by including all the domains as subject alternative names.

Is it ok for a single domain to have multiple SSL certificates with same DN and validity?

This is possible too. And while it is unusual to have multiple SSL certificates with same subject and exactly the same validity it is common to have certificates with same subject but overlapping validity, i.e. when renewing a certificate which is about to expire.

Can we include CA related information (serial number, name or id etc) in the attribute of SSL certificate DN?

If you have full control over the CA you can do this. Be in the normal case of using a publicly trusted CA you don't have this control. The CA will only pick the information from the CSR (certificate signing request) which it finds appropriate, which is commonly only the subject(s).

If possible please provide name or link to the RFC / standard for further guidance.

For general information about X.509 PKI structures see RFC 5280. For specifics regarding publicly trusted CA see CA browser forum baseline requirements.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.