I'm generating self-signed X.509 certificates so I can use TLS in peer-to-peer applications. My problem is that the identifier of each peer is an arbitrary string of bytes derived from the public key, so I'm not sure where would I fit such identifier in the X.500 name fields. Ideally it wouldn't even be in one of those, to avoid unnecessary encoding/decoding to/from strings.

What would be the indicated way of going about it?

  • 2
    What you are doing seems similar to what Tor does, where addresses of hosts on the Tor network are derived from a public key. Certificates used to secure connections between nodes are self-signed, and the node's address is contained in the SAN field and/or the Common Name field of the certificate. See security.stackexchange.com/questions/260492/… for more info.
    – mti2935
    Commented May 12 at 11:54

1 Answer 1


The Subject Alternative Name (SAN) extension supports OtherName entries with the following definition.

OtherName ::= SEQUENCE {
        type-id    OBJECT IDENTIFIER,
        value      [0] EXPLICIT ANY DEFINED BY type-id }

So you can pick an arbitrary registered object identifier (OID) that is suitable for your peer IDs and store the OID/value pair as a SAN. For example, there's (uniqueIdentifier) which is a BIT STRING.

Of course your applications will need a custom parsing mechanism to get the peer ID. A simpler approach would be to encode the binary ID as a UTF-8 string (using Base64, for example) and put it into the Common Name.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .