I keep reading that in an X.509 certificate chain of trust that the "Issuer Name" in a certificate that has been signed by the Issuer must "match" the "Subject Name" of the Issuer's certificate. Exactly how is this match determined? Do all of the RDNs (Relative Distinguished Names) have to match between both the Subject Name and Issuer Name or is the match determined solely by the RDNs that are present in the Issuer certificate's Subject Name, or is some other match algorithm at work?
As per RFC 5280 §220.127.116.11 (and as specified in §7.1), binding is done by using case-insensitive match between
Issuer distinguished name string of leaf certificate and
Subject distinguished name string of a potential issuer.
Bear in mind that Key Match, Exact Match, Name Match techniques are used only to bind certificates and build as much chains as possible (build complete chain tree). It doesn't tell anything about trust/validity. When completed, tree is passed to validation routine which excludes invalid/non-suitable certificates and returns only single best chain. Full validation process is defined in RFC 5280 §6.
Certificate validation is a 3-step process:
- Tree building (from leaf to root)
- Tree validation (from root to leaf)
- Revocation checking (from leaf to root)
Name Match binding is used only during first process.