According to RFC5280, a subject/issuer Name is a sequence of RelativeDistinguishedName, which in turn in a set of AttributeTypeAndValue (see https://www.rfc-editor.org/rfc/rfc5280#section-

There is no doubt that (RFC2253 notation) these Names are valid:

Single value RDNs, repeating Type OID: CN=A,CN=B

Multivalue RDNs with separate type OIDs: CN=A+OU=B

But is my interpretation correct, that (RFC2253 notation) this Names would also be valid:

Multivalue RDNs with repeated type OID: CN=A+CN=B

But this one would not be:

Multivalue RDNs with repeated (type OID and value): CN=A+CN=A

My initial assumtion would have been that within any RDN every type OID may occur at most once (giving it a dictionary syntax), and I remember having that read somewhere, but am unable to find the reference again. From the pure syntax, it appears that "CN=A+CN=B" seems permissible.


CN=A+CN=A is legal, too. ITU-T X.680 (2015/08) says, for SET OF (28.3)

NOTE 1 – Semantic significance should not be placed on the order of these values.

NOTE 2 – Encoding rules are not required to preserve the order of these values.

NOTE 3 – The set-of type is not a mathematical set of values, thus, as an example, for SET OF INTEGER the values { 1 } and { 1 1 } are distinct.

(emphasis mine)

Note #1 says that CN=A+CN=B is the same as CN=B+CN=A. Since X.509 public key certificates say that their encoding uses the Distinguished Encoding Rule set (DER) the latter won't be found, because DER requires that the set be sorted (using sorting rules that are not obvious without looking at the encoded data).

Without any qualifying statement in the specification (that any given OID cannot have more than one appearance in the SET OF) there's nothing preventing redefintion, or duplicates. X.509 doesn't have any such statements.

But, for what it's worth, multi-value RDNs are pretty rare in X.509 public key certificates.

  • Spot-on answer, thank you very much. I'm aware that multi-value RDNs are seldomly used, but want to get the semantics exactly right. Incredibly useful reference, highly appreciated.
    – itecMemory
    Aug 24 '18 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.