0

It is not clear to me how the Common Name affects a certificate authority and the certificates that are ultimately created. For example, I have this simple script that creates some files for a certificate authority auto-generated/ca.* and an ssl certificate for hello.test.com.

#!/bin/bash

ORG="ABTEST"
CN="blahblahthisdoesnotmatterquestionmark"
certdir="./auto-generated"

mkdir -p $certdir;
cp entity.cnf $certdir"/";

## Create certificate authority
openssl genrsa -out $certdir/ca.key 2048
openssl req -x509 -sha256 -nodes -key $certdir"/ca.key" -subj "/C=CA/ST=ON/O="$ORG"/CN="$CN -days 3650 -out $certdir"/ca.crt"

## Create entity certificate

# Private Key
openssl genrsa -out $certdir/entity.key 2048
# CSR
openssl req -new -sha256 -nodes -key $certdir"/entity.key" -config $certdir"/entity.cnf" -out $certdir"/entity.csr"
# Certificate
openssl x509 -req -in $certdir"/entity.csr" -CA $certdir"/ca.crt" -CAkey $certdir"/ca.key" -CAcreateserial -out $certdir"/entity.crt" -days 500 -sha256 -extensions v3_req -extfile $certdir"/entity.cnf"

entity.cnf

[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
C = CA
ST = ON
L = Windsor
O = Ankle
OU = Hello
CN = hello.test.com
[v3_req]
keyUsage = critical, digitalSignature, keyAgreement
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = hello.test.com

It seems I can change the variable CN=blahblah... to anything I want and it doesn't have any technical/functional effects on the entity.crt. Meaning I can go to Firefox browser and visit https://test.hello.com and see a green lock icon if I follow these steps:

  1. choose any value I want for CN=blahblah...
  2. create the ca.* and entity.* files
  3. set up Apache Web server on the computer hello.test.com
  4. tell Apache web server to use entity.* and ca.crt for ServerName hello.test.com
  5. systemctl restart apache2
  6. import ca.crt into my FireFox web browser

So my question is, what are the criteria for choosing a Common Name for a certificate authority? What do I need to be aware of to make sure client applications can verify my certificates?

3
  • 1
    You can create a CA cert with any common name that you want. You can then use the CA cert to sign leaf certs. Then, you can import the CA cert into the client's trust store, and the client will trust the leaf certs, being that it trusts the CA cert.
    – mti2935
    Jan 30 at 21:47
  • 1
    @mti2935: almost any name within the size constraint (ub-common-name = 64 in rfc5280). If the subject name in an EE cert is the same as the CA name i.e. issuer, the cert doesn't validate and can't be used, so your CA name must not be one you will or may later use for any EE. Since EE names for SSL/TLS are almost always FQDNs, any CA name that is not FQDN is safe. Jan 31 at 4:42
  • @dave_thompson_085, Good to know. Thanks for adding this.
    – mti2935
    Jan 31 at 16:31

1 Answer 1

1

From a technical standpoint, the Common Name of a CA is entirely arbitrary. It makes no difference whether the CA is called GeoTrust Inc. or Hongkong Post or blahblahthisdoesnotmatterquestionmark. As long as the CA is in the browser's trust store, the browser will trust (valid) certificates issued by this CA. If you wanted to set up a public CA, then there could be laws, rules or guidelines for the name, but this does not apply to CAs you only use privately.

The name of the server certificate does matter, of course. However, using the Common Name to specify the DNS name of the server is deprecated. Instead, the Subject Alternative Name extension should be used (which you're already doing).

For example, RFC 2818 says:

If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead.

The Baseline Requirements of the CA/Browser Forum even require the SAN extension, while the CN is redundant and optional.

7.1.4.3 Subscriber Certificate Common Name Attribute

If present, this attribute MUST contain exactly one entry that is one of the values contained in the Certificate’s subjectAltName extension (see Section 7.1.2.7.12).

7.1.2.7.12 Subscriber Certificate Subject Alternative Name

For Subscriber Certificates, the Subject Alternative Name MUST be present and MUST contain at least one dNSName or iPAddress GeneralName.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .