Is there an effect of a certificate, or the request for, having the wrong country code? How about the other metadata? Effects can be legal, technological, anything.

I could almost imagine a web browser checking the certificate country and province against the server's geolocated ip, but I could see that having false positives, especially in the days of cloudflare and similar services.

  • Server certificates with included country code are quite a minority. Most of them are only "domain control validated" and contain only CN=www.domainname.com
    – fraxinus
    Commented Nov 5, 2020 at 10:22

2 Answers 2


The reason certificates have the metadata they do is historical. Certificates are defined in the X.509 standard from the ITU-T. It is part of implementation of the X.500 standard, the Directory services. It’s also related to another standard called LDAP

These technologies were designed at the beginning of the internet (1988) and have a strong backing in the telephone networks.

The X.500 family of standards were created to facilitate directory services (think phone books). For these it makes sense to record where someone is located in order to tie some arbitrary data (like a phone number) to a physical location or name (like address and name of user).

These features are mainly still present for humans to use. Computers use other means to validate them (like OCSP and the older CRL; a valid period of time, as in not valid before and not valid after values; and trusted root certificates or CA’s, that vouch for the certificate used).

Nowadays there might be a legal requirement to fill in such data accurately but there is no technical reason to enter it aside from auditing and for use by humans.

  • 13
    AFAIK the original idea was that there would be one Global X.500 Directory, branching out almost exactly like how DNS works nowadays – e.g. France would be delegated the C=FR subtree; Microsoft would manage the O=Microsoft,C=US subtree; and so on.
    – grawity
    Commented Nov 5, 2020 at 9:10
  • 7
    Correct. That was the original, never fully implemented plan for DAP. It’s why we got LDAP. It would not be directly linked to just the C & O records but also by the issuer records.
    – LvB
    Commented Nov 5, 2020 at 9:13

Certificates don't have necessarily a country code set. I myself have several public certificates with no country code, which are signed without problems by Let's Encrypt. But if a certificate belongs to an organization it is pretty common to provide the actual information for this organization. For simple domain validated (DV) certificates these are purely informative only though.

With Extended Validation (EV) certificates this is different: the information shown in the certificate are checked by the CA to reflect the organization.

  • 6
    Empty or omitted? Empty violates the ASN.1 in RFC5280 and X.520 which say PrintableString SIZE(2) (unlike most other standard attributes which are DirectoryString{maxsize=whatever} or UnboundedDirectoryString) and add the nonsyntactic constraint that it must be an alpha-2 value from 3166-1 (none of which are empty). OTOH omitted is just fine. Commented Nov 5, 2020 at 1:54
  • @dave_thompson_085: thanks for pointing out this detail. The certificates in question have no country code at all, I've fixed the answer accordingly. Commented Nov 5, 2020 at 5:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .