2

We currently use some certificates in our application and we identify them by using the certificate's thumbprint.

Like this:

<serviceCertificate>
    <certificateReference x509FindType="FindByThumbprint" findValue="xxxx" storeLocation="LocalMachine" storeName="My" />
  </serviceCertificate>

Unfortunately when the certificates are up for renewal, this thumbprint changes.

Is there any other way like the "SubjectName" that we safely can use to identify the certificate? And that, of course, stays the same when we renew the certificate?

1

Your certificate must be identified at least using his Common Name (CN), or at best using his Distinguished Name (DN).

The Distinguished Name is based upon X.500 directory service standard, and is actually a hierarchical set of property/value couples allowing a unique identification of a given certificate, independently of technical certificate properties (key, usages, serial number, validity period, issuer, etc.).

For instance, the Distinguished Name from the current Stack Exchange website is C = US, ST = CA, L = San Francisco, O = "CloudFlare, Inc.", CN = *.stackexchange.com, which can be decomposed the following way to clearly see the hierarchical relation between each properties (it goes from the more general to the more precise):

C = US                       // Country = United States
ST = CA                      // State = California
L = San Francisco            // Locality = San Francisco
O = "CloudFlare, Inc."       // Organization = CloudFlare, Inc
CN = *.stackexchange.com     // Common Name = matches the URL hostname

The details of the attributes composing your certificate will heavily depend on your application and needs (some attributes may even appear several times with different values, the most common example being the OU (Organization Unit) attribute).

Do not hesitate to check the other question given in the beginning of this answer to get more information on the subject.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.