Allowed Relative Distinguished Names (RDNs) in the Subject of Issued Certificates

Author Uwe Gradenegger Posted on Updated on Categories Certificate usage Tags RFC 2818, RFC 5280, Relative distinguished name (RDN), SubjectTemplate, ISO 3166, Subject alternative name (SAN), RFC 4519, Subject distinguished name

In principle, RFC 5280 allows the use of arbitrary strings in the subject distinguished name (DN) of a certificate. Common fields are described in the X.520 standard. The length restrictions are also recommended by the ITU-T . The abbreviations commonly used today are mainly taken from RFC 4519 .

However, Microsoft Active Directory Certificate Services only allows certain RDNs by default.

The following Relative Distinguished Names (RDNs) are accepted by the Active Directory Certificate Services (AD CS) certification authority by default:

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.

RDNDescription
emailAddress (E, EMAIL)
Maximum 128 characters		The e-mail address of the certificate holder in the format name@domain.tld . For e-mail signature and encryption certificates, the identity is formed from this field.
commonName (CN)
Maximum 64 characters		The common name. This can be used to map the identity of the certificate owner.
However, for web server certificates, for example, according to RFC 2818 this should be avoided and the Subject Alternative Name (SAN) should be used instead . Free text.
organizationName (O)
Maximum 64 characters		The name of the certificate holder's organization. Free text.
organizationalUnit (OU)
Maximum 64 characters		The organizational unit (e.g. the specialist department) of the certificate holder. Free text.
localityName (L)
Maximum 128 characters		The locality (for example, the city) of the certificate holder. Free text.
postalCode (POSTALCODE)The zip code (e.g. "63486") of the certificate holder. Free text.
stateOrProvinceName (ST, S)
Maximum 128 characters		The federal state (e.g. "Hessen") of the certificate holder. Free text.
countryName (C)
Maximum 2 characters		A two-character country code according to ISO 3166
domainComponent (DC)
Maximum 128 characters
unstructuredName (OID.1.2.840.113549.1.9.2)
1024 characters maximum		(not activated in the default setting)
unstructuredAddress (OID.1.2.840.113549.1.9.8)
1024 characters maximum		(not activated in the default setting)
deviceSerialNumber (SERIALNUMBER)
1024 characters maximum		(not activated in the default setting)
title (T)
Maximum 64 characters		(not activated in the default setting)
givenName (G)
Maximum 16 characters		(not activated in the default setting)
initials (I)
Maximum 5 characters		(not activated in the default setting)
surname (SN)
Maximum 40 characters		(not activated in the default setting)
streetAddress (STREET)
Maximum 40 characters		(not activated in the default setting)

The limitation of the character lengths is based on the recommendations of the ITU-T . It can be deactivated. See the article "Certificate request fails with error message "Error Parsing Request The request subject name is invalid or too long. 0x80094001 (-2146877439 CERTSRV_E_BAD_REQUESTSUBJECT)" ". In addition, the entire subject distinguished name (DN) is limited to 4096 characters, and to 4096 bytes for the ASN1-encoded form of the subject distinguished name (DN). The size limit for all certificate extensions (including the subject alternative name) is also 4096 bytes.

The setting can be checked with the following command line command on the certification authority:

certutil -v -getreg CA\SubjectTemplate

Command prompt: certutil -v -getreg CA\SubjectTemplate shows SubjectTemplate REG_MULTI_SZ with EMail, CommonName, OrganizationalUnit, Organization, Locality, State, DomainComponent, Country

This setting is variable. For example, installing an NDES server adds more RDNs .

By default, the certification authority will enter the RDNs into issued certificates exactly in the order defined here. Some applications have problems with this behavior . The order can be changed , or the certification authority can be configured to accept the requested subject without further checks .

Fine-grained control over which RDNs and which contents are allowed in manual certificate requests can be achieved with the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services .

External sources