38

Is there an effect of a certificate, or the request for, having the wrong country code? How about the other metadata? Effects can be legal, technological, anything.

I could almost imagine a web browser checking the certificate country and province against the server's geolocated ip, but I could see that having false positives, especially in the days of cloudflare and similar services.

Improve this question
1
  • Server certificates with included country code are quite a minority. Most of them are only "domain control validated" and contain only CN=www.domainname.com – fraxinus Nov 5 '20 at 10:22
45

The reason certificates have the metadata they do is historical. Certificates are defined in the X.509 standard from the ITU-T. It is part of implementation of the X.500 standard, the Directory services. It’s also related to another standard called LDAP

These technologies were designed at the beginning of the internet (1988) and have a strong backing in the telephone networks.

The X.500 family of standards were created to facilitate directory services (think phone books). For these it makes sense to record where someone is located in order to tie some arbitrary data (like a phone number) to a physical location or name (like address and name of user).

These features are mainly still present for humans to use. Computers use other means to validate them (like OCSP and the older CRL; a valid period of time, as in not valid before and not valid after values; and trusted root certificates or CA’s, that vouch for the certificate used).

Nowadays there might be a legal requirement to fill in such data accurately but there is no technical reason to enter it aside from auditing and for use by humans.

Improve this answer
2
  • 11
    AFAIK the original idea was that there would be one Global X.500 Directory, branching out almost exactly like how DNS works nowadays – e.g. France would be delegated the C=FR subtree; Microsoft would manage the O=Microsoft,C=US subtree; and so on. – user1686 Nov 5 '20 at 9:10
  • 7
    Correct. That was the original, never fully implemented plan for DAP. It’s why we got LDAP. It would not be directly linked to just the C & O records but also by the issuer records. – LvB Nov 5 '20 at 9:13
11

Certificates don't have necessarily a country code set. I myself have several public certificates with no country code, which are signed without problems by Let's Encrypt. But if a certificate belongs to an organization it is pretty common to provide the actual information for this organization. For simple domain validated (DV) certificates these are purely informative only though.

With Extended Validation (EV) certificates this is different: the information shown in the certificate are checked by the CA to reflect the organization.

Improve this answer
2
  • 5
    Empty or omitted? Empty violates the ASN.1 in RFC5280 and X.520 which say PrintableString SIZE(2) (unlike most other standard attributes which are DirectoryString{maxsize=whatever} or UnboundedDirectoryString) and add the nonsyntactic constraint that it must be an alpha-2 value from 3166-1 (none of which are empty). OTOH omitted is just fine. – dave_thompson_085 Nov 5 '20 at 1:54
  • @dave_thompson_085: thanks for pointing out this detail. The certificates in question have no country code at all, I've fixed the answer accordingly. – Steffen Ullrich Nov 5 '20 at 5:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.