1

I am learning about SSL certificates and doing some testing with a web server on my machine. I am trying to understand which field are required to be in the server certificate in order to be accepted by the browser. So far I came to this conclusions.

Certificate contains this information

  • Version and serial number.
  • Information about the issuer: country, state, city, organization, organization unit common name, email.
  • Validity: not before date, not after date.
  • Information about the the subject: country, state, city, organization, organization unit, common name, email.
  • Subject public key: algorithm, length, key.
  • Other information (extensions), like subject alternative name for example.

What is required

  • The certificate has to be signed by a trusted CA.
  • The Common Name of the subject has to be present and correspond to the domain name of the site.
  • A certificate can be valid for multiple hostnames, in which case they have to be specified in the Subject Alternative Name extension. Some browsers require this extension to be present in the certificate.
  • The validity date has to be valid and therefore can not be empty
  • I'm not aware of any browsers that require a Subject Alternative Name. – ceejayoz Feb 1 at 17:35
  • 1
    @ceejayoz Subject alternate name is required, per 7.1.4.2.1 of the CAB requirements. – Zoredache Feb 1 at 17:47
  • 1
    I have created my own CA and the server cert. First I did it without SAN and I got this error on Chrome:NET::ERR_CERT_COMMON_NAME_INVALID This server could not prove that it is localhost; its security certificate does not specify Subject Alternative Names. This may be caused by a misconfiguration or an attacker intercepting your connection. After adding SAN to the server cert, it started to work. – mangitsi Feb 1 at 17:59
  • 1
    @ceejayoz Well the question is function today, or function in the long term. CAB is run by browser vendors. They added SAN as a MUST requirement. So your certs without a SAN, might work with your browser today, but at some point I expect they won't work. Course that is partly a flaw of this question. Asking what is required to work generally won't get a great answer because it can be slightly different between the tons of implementations. Answering from the point of the spec is easier. – Zoredache Feb 1 at 17:59
  • 1
    @ceejayoz Looks like Chrome is enforcing this now. – Michael Hampton Feb 1 at 18:01
4

One good place place to look for these details is in the CA Browser https://cabforum.org/ forum baseline requirements document.

The details for all certificates involved can be found in section 7.

  • 1
    Thanks for the links. After going through the MUST in the baseline requirements, I would like to add the following to complement the list I did in the question: - Certificates issued must have a Validity Period no greater than 825 days and reuse of validation information limited to 825 days. - Underscore characters must not be present in dNSN name. - Applicant information MUST include, but not be limited to, at least one Fully-Qualified Domain Name or IP address to be included in the Certificate’s SubjectAltName extension. – mangitsi Feb 1 at 18:16

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.