10

I am really confused about the country, state and city I should select when submitting an SSL certificate. Should I provide the location of my servers or my current home address?
I can always reissue a certificate, but can this somehow cause problems in future?

This may sound as a trivial question but I couldn't find any info.

  • 1
    A quick Google search says clearly that it's the Organization's country, state, and city. – schroeder Jul 17 '15 at 18:55
  • 3
    @schroeder, But what does that mean? That is what this question is about. My website isn't a company... Is the Organization address the one where the servers reside? But what If I have servers worldwide? Or is the Organization address my home address? – Core_dumped Jul 17 '15 at 19:22
  • 2
    It's about the entity buying the certificate (the Organization). If that's you, then you put in your home address. It's not the location of the servers. – schroeder Jul 17 '15 at 21:05
  • 1
    Or your PO BOX, or whatever... if you don't want everyone in the universe to know where you live. – trognanders Jul 17 '15 at 22:33
7

Generally speaking, in the certificate request, these values do not matter. What matters is what appears in the resulting certificate, and the certificate contents will be chosen by the CA, not by you. The certificate request is a vessel to convey your public key to the CA; that request uses a format (normally PKCS#10) that includes a space of a "subject name", but this field must be understood as, at best, a polite suggestion to the CA.

The CA, upon receiving the request, must make sure that it comes from an authenticated customer (e.g. the request is sent through a Web-based interface with client authentication), and will fill the certificate with values that characterize that authenticated customer, according to the CA certification policy. The CA might allow you to specify some of the fields through the request, but most will simply ignore the name in the request. They know it comes from you, and they will put your name.

If the CA actually lets you choose the country, state and city in the certificate (either by specifying them in the request, or through some other out-of-request configuration), then the intent is that these information qualify the organization that owns the certificate (e.g. the country, state and city where you chose to put your corporation headquarters). In any case, Web browsers won't validate any of these values, and won't show them to the user (except to users who click on two or three "show me the details" buttons successively). To sum up, the values don't really matter, but you don't want to put anything too embarrassing here because some inquisitive, nosy people could actually have a look at them.

  • Does the suggested name, appear anywhere in the ASN1? (assuming that the CA doesn't take the suggestion) – goodguys_activate Jul 17 '15 at 20:46
  • There is no standardized method for the CA to put in the certificate the parts of the requests that it does not want to put in the certificate. If you take my meaning. Basically, if the CA decides to fully ignore the name you provided, then it fully ignores that name and you won't see it anywhere. – Tom Leek Jul 17 '15 at 20:58
  • I guess I never understood the contents of a CSR... I always assumed it was just signed in a CA signing cert, but it appears this isn't the case, and only a subset is signed. – goodguys_activate Jul 17 '15 at 21:03
  • A PKCS#10 certificate request contains the public key you want to see appear in the certificate. It may contain a lot of other things (it is an extensible format, with extensions) but the CA is free to pick what it wants from the request and ignore the rest. The public key is about the only thing that the CA necessarily uses from the request, and most CA will use only that and ignore the rest. – Tom Leek Jul 17 '15 at 21:10
  • Is there any cryptographic verification of any data? Could the public key be a blob that has no corresponding private key? (just asking for conceptual understanding, not an attack vector). For comparison, I thought that the public key was "signed" to act as a ZKP – goodguys_activate Jul 17 '15 at 21:14
3

The CA/Browser Forum Baseline Requirements (PDF) specifies that these fields in the Subject of the certificate should be filled in accordance with the validation of the identity and address of the requestor by the CA. This validation shall be done with a document or information provided by:

  1. A government agency in the jurisdiction of the Applicant’s legal creation, existence, or recognition;
  2. A third party database that is periodically updated and considered a Reliable Data Source;
  3. A site visit by the CA or a third party who is acting as an agent for the CA; or
  4. An Attestation Letter.

Thus, the country, state and locality fields should be the legal address of the certificate requestor.

But from a practical point of view, most of the time you do not have to specify the values in the certificate request sent to the CA since the CA will automatically add them in the certificate Subject according to result of the identity/address validation.

  • opften they use option number 2, the database being the domain name service, and verify your domain ownership by you serving a file or reveiving a mail on that domain. – Jasen Jul 18 '15 at 12:53
2

You should provide the information of the company (postal address being the HQ's location) or your own information if you're an individual.

Truth is, for an automatically-issued DV (domain validation) certificate, nobody is going to check and all you really care for is that the CN (common name) matches the hostname of the server you're getting the certificate for.

  • 2
    @Core_dumped changing it will require to revoke the current certificate and issue a new one. If your CA allows this for free (or you're okay with their fees), it's just a matter of creating a new CSR with the changed info and submitting it to the CA, and finally installing the new certificate on the server once you receive it. – Anonymous Jul 17 '15 at 19:53
  • 1
    @Core_dumped, (1) please don't use the comments to ask follow-up questions -- they should either be part of your original question (you can edit it) or asked as a separate question, (2) please don't spam the same comment underneath multiple answers. – D.W. Jul 17 '15 at 22:35
1

The required information are information about the owner of the domain and have nothing to do with the location of the server. This is similar to the registrant in DNS. This means if you own the domain as an individual there is no organization.

  • 2
    @Core_dumped: a certificate can not be changed afterwards. You can only get a new certificate and the previous one needs to be revoked. Usually this is associated with additional costs. – Steffen Ullrich Jul 17 '15 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.