Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm working on a project, where we use the Common Name as a certificate's basic identifier. However, importing certificates without the Common Name fails.
What's the default way to use digital certificates? Which identifier should we choose to be able to import them?
As far as X.509 is concerned, the Common Name is not mandatory. However, a number of systems will use the CN for display purposes, e.g. most "certificate manager" GUI in Windows. Therefore, it is recommended, if only for ease of sysadmin tasks, to include reasonably precise CN in certificates.
If you want to, from an application, pinpoint a specific certificate, then the good identifier to use is the "thumbprint", which really is a hash of the certificate. As long as the hash function is collision-resistant (Microsoft uses SHA-1, which is still quite robust in that respect), no two distinct certificates will exhibit the same thumbprint.
The "standard X.509" method of referencing a specific certificate is to use the pair issuerDN + serial number. Only the combination of both values is (supposedly) unique; serial numbers alone don't cut it. Mind that I am talking about the issuer's name, not the subject's; and this is the whole DN, not just the CN part of it. Moreover, it is allowed for a certificate to have an empty issuerDN provided it also contains an Issuer Alt Name extension with the complete DN. This means that properly using the issuer+serial pair can be somewhat complex. The thumbprint is easier.
In case of HTTPS protocol, Common Name can also be used by some of the client applications for verification of the server's identity. The RFC 2818 says the following about the server's identity:
If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead.
This means that, in case of HTTPS protocol, servers should use the subjectAltName as the main source of identifier and support the Common Name for backward compatibility.
