stateOrProvinceName is abbreviated to
ST. Should we assume that it is best practice to put
ST=<name-of-state> in the certificate if the state or province is indicated? After all X-500 also has the acronyms
SP reserved for state or province.
Which acronyms should we allow when it comes to accepting certificates? Should we make sure that the acronyms match, or should we only compare the actual values? Should we reject the certificate in the strange case that we have multiple values?
I guess that OID's have also been specified, would it be an idea to use those instead of the acronyms. Could we use the full
stateOrProvinceName as well?
Finally, I would like to know how OpenSSL handles this during creation and validation, as it is probably the most used application to create leaf certificates and probably the most common server side TLS implementation as well.