证书主题 X.509
根据 X.509，证书具有属性主体。
C=US, ST=Maryland, L=Pasadena, O=Brent Baccala, OU=FreeSoft, CN=www.freesoft.org/[email protected]
这是典型的主题值。问题是这些属性（C、ST、L、O、OU、CN）的类型（或标签）是什么以及它们的格式是什么？
According to the X.509, a certificate has an attribute subject.
C=US, ST=Maryland, L=Pasadena, O=Brent Baccala, OU=FreeSoft, CN=www.freesoft.org/[email protected]
This is the typical subject value. The question is what are the types (or tags) of those attributes (C, ST, L, O, OU, CN) and what is their format?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
IETF PKIX（最新版本 RFC 5280）是公认的证书配置文件。从第 4.1.2.4 节开始，必须支持以下字段（我在括号之间添加的是 OpenSSL 长名称和可选的短名称）：
还有一个应该支持的元素列表：
值应以 UTF8String 或 PrintableString 编码（其中一些仅以 PrintableString 编码，有些例外以 IA5String 编码）。该标准还规定了所有字段类型的最大长度（附录 A.1）。
出于兼容性原因，实现还必须支持以 IA5String 编码的域组件（domainComponent、DC）。注意电子邮件 (emailAddress) 及其编码 (IA5String，但它在 DN 中被认为已弃用（它应该在主题备用名称扩展中）。
IETF PKIX (latest version RFC 5280) is a well accepted profile for certificates. From section 4.1.2.4, the following fields must be supported (I've added between parenthesis is the OpenSSL long and optional short name):
There's also a list of element that should be supported:
Values should be encoded in UTF8String or PrintableString (some of them only in PrintableString, and some exceptions in IA5String). The standard also has a maximum length for all field types (Appendix A.1)
For reasons of compatibility, implementations must also support domain components (domainComponent, DC) encoded in IA5String. Attention is drawn to email (emailAddress) and its encoding (IA5String, but it's considered deprecated in DNs (it should be in Subject Alternative Name extension).
对于那些想要这些属性的确切格式的人来说，RFC5280 中没有给出：
大写标签的详细信息请参见 RFC4519这是 LDAP 架构。本文档还链接到其他 RFC，描述每个特定属性和数据类型的精确语法和语义。
例如，国家/地区代码“C”遵循 RFC4517 和 ISO3166 它给出了实际的两个字母代码。域组件“DC”是符合 RFC1034 的 dns 名称。
For those wanting the exact format of these attributes, which is not given in RFC5280:
The capitalized tags are detailed in RFC4519 which is the LDAP schema. This document also links to other RFCs describing the precise syntax and semantics for each specific attribute and datatype.
For example, the country code "C" follows RFC4517 and ISO3166 which gives the actual two-letter codes. And the domain component "DC" is a dns name in accordance with RFC1034.
除了参考 RFC 5280 的优秀答案之外，还请参阅 RFC 8399 RFC 国际化更新5280。 RFC 8399 指定如何处理国际化域名和电子邮件地址，与更新的 IDNA 2008 一致。 RFC 5280 与过时的 IDNA 2003 保持一致，并不清楚如何处理本地部分不限于 ASCII 的电子邮件地址。
In addition to the excellent answer referring to RFC 5280, also consult RFC 8399 Internationalization Updates to RFC 5280. RFC 8399 specifies how to handle internationalised domain names and email addresses, in accordance with the updated IDNA 2008. RFC 5280 is aligned with the outdated IDNA 2003, and is not clear about how to handle email addresses where the local part is not limited to ASCII.