Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is there an effect of a certificate, or the request for, having the wrong country code? How about the other metadata? Effects can be legal, technological, anything.
I could almost imagine a web browser checking the certificate country and province against the server's geolocated ip, but I could see that having false positives, especially in the days of cloudflare and similar services.
The reason certificates have the metadata they do is historical. Certificates are defined in the X.509 standard from the ITU-T. It is part of implementation of the X.500 standard, the Directory services. It’s also related to another standard called LDAP
These technologies were designed at the beginning of the internet (1988) and have a strong backing in the telephone networks.
The X.500 family of standards were created to facilitate directory services (think phone books). For these it makes sense to record where someone is located in order to tie some arbitrary data (like a phone number) to a physical location or name (like address and name of user).
These features are mainly still present for humans to use. Computers use other means to validate them (like OCSP and the older CRL; a valid period of time, as in not valid before and not valid after values; and trusted root certificates or CA’s, that vouch for the certificate used).
Nowadays there might be a legal requirement to fill in such data accurately but there is no technical reason to enter it aside from auditing and for use by humans.
Certificates don't have necessarily a country code set. I myself have several public certificates with no country code, which are signed without problems by Let's Encrypt. But if a certificate belongs to an organization it is pretty common to provide the actual information for this organization. For simple domain validated (DV) certificates these are purely informative only though.
With Extended Validation (EV) certificates this is different: the information shown in the certificate are checked by the CA to reflect the organization.
PrintableString SIZE(2) (unlike most other standard attributes which are DirectoryString{maxsize=whatever} or UnboundedDirectoryString) and add the nonsyntactic constraint that it must be an alpha-2 value from 3166-1 (none of which are empty). OTOH omitted is just fine.
Nov 5 '20 at 1:54