3

Should an e-mail address in a Certificate Signing Request (CSR) for a server with a domain name aaa.bbb.ccc.ddd contain exactly all domain zones or it can be MyName@ccc.ddd (in other words, just an organizational top-level domain)?

Context: I'm relying on this guide, but the installation will be done on a private cloud, not Linode.

5

The email address in the request doesn't need to relate to the DNS names in the certificate at all. It could be a gmail address if you wanted. It's just metadata and a hypothetical way for someone to contact the owner of an SSL protected site. Technically it's not even required metadata. It's completely up to the Certificate Authority whether they want to require it or not. Though some Certificate Authorities do use the e-mail address field to verify that you can receive email on that domain.

  • I appreciate your fast and clear answer (upvoting and accepting). I thought that there is a technical dependency, but, based on your reply, it seems that my assumption was wrong. By the way, could you comment on what ports CAs use to verify the trustworthiness of CSR requesters (asking since my server is behind a firewall)? – Aleksandr Blekh Jun 10 '16 at 6:53
  • 1
    If by "verify the trustworthiness" you mean how the CA validates that you own the domain you're requesting the cert for....that tends to vary between CAs and can be dependent on the type of cert you're requesting. The two most common ways involve having you add a specific DNS record within your domain's zone or hosting a specific file from a web server listening on your domain name. – Ryan Bolger Jun 10 '16 at 7:02
  • 1
    I've never purchased an EV cert, but from what I understand, the ownership validation process is longer and more involved. – Ryan Bolger Jun 10 '16 at 7:04
  • Thank you for clarifications. I will talk to people from the Office of IT in my organization. We already use plenty of certificates (I don't remember seeing EV ones, though), but I'm not sure, if it is possible to just "inherit" a certificate for a top-level organizational / org. unit's domain. – Aleksandr Blekh Jun 10 '16 at 7:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.