For example:

from Issued SSL Certificate:
CN = abc.com.my, OU = Room, O = House, C = MY

from generated CSR:
CN = abc.com.my, OU = Room , O = House, L = KL, ST = KL , C = MY

Is it legal for a public CA to change the distinguished name when issuing the SSL certificate, or must the distinguished name exactly match what I provided in the CSR?

Or do only some required fields need to match in both, such as the Fully qualified Domain Name (FQDN)?

  • 1
    "Fully Qualified Domain Name (FQDN)..." - FQDN end in dot. They allow you to locate in host in the DNS tree. If you have a local DNS and a record for www. (notice the dot), then that's full qualified but not available in public DNS. If you host has a record in public DNS with the name www.example.com.(notice the dot), then it too is fully qualified. www and www.example.com are not fully qualified, and its the network resolver's job to figure out the domain suffixes (if needed). – user29925 Apr 6 '15 at 22:28

It is legal and possible for the CA to take a CSR and modify the DN it finds there before issuing the certificate.

For instance, with StartSSL free certificates they ignore the DN provided and issue based solely on the public key, the domain name requested (CN), the country (C), and email of the requester (E). And according to the user interface, everything but the public key comes from the interactive request process, not the CSR itself:

All content of the certificate signing request is ignored except its public key

  • My understanding from the guidelines, only two or three required attributes such as CN need to be included. – epiziv Sep 17 '14 at 14:35
  • What i think before this, distinguished name at CSR must be same as issued certificate because it is a proof of the integrity and origin of data.(Non-repudiation) thanks @gowenfawr for show real example from startssl. – epiziv Sep 17 '14 at 14:42
  • What exactly makes you assume that it's "legal" to change the DN? The RFC behind the certificate requests ( RFC 2896) says that the CA takes the DN from the request. Are there any newer regulations regarding the subject DN? – Eugene Mayevski 'Callback May 4 '17 at 9:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.