Cyberstudy
PDF p.62 In progress

Subject Name Attributes

Open PDF at p.62 17 flashcards

Summary

PDF p.62

The common name (CN) attribute was initially used to identify the fully qualified domain name (FQDN) of a server but is now deprecated for this purpose. The subject alternative name (SAN) extension field is used to represent different types of identifiers, including FQDNs and IP addresses. Certificates also contain fields for organization details, forming a Distinguished Name (DN). Different certificate types serve various purposes, such as email certificates and code-signing certificates.

In plain words

Supplementary — not from your PDF

Browsers match a site's address against the Subject Alternative Name (SAN) list in its certificate. The old Common Name (CN) field is no longer relied on. A SAN can list several names or a wildcard such as *.example.com.

Detailed explanation

PDF p.62
  • Common Name (CN)
    • Initial Use: Identified the FQDN of a server (e.g., www.comptia.org).
    • Deprecation: CN can contain various information, making it difficult for browsers to interpret correctly.
  • Subject Alternative Name (SAN)
    • Purpose: Represents different types of identifiers, including FQDNs and IP addresses.
    • Validation: Browsers should validate the SAN and ignore the CN if SAN is present.
    • Subdomains: SAN can list specific subdomains (e.g., www.comptia.org, members.comptia.org) or use a wildcard domain (e.g., *.comptia.org) for all subdomains.
  • Distinguished Name (DN)
    • Components: Includes fields for Organization (O), Organizational Unit (OU), Locality (L), State (ST), and Country (C).
    • Example: CN=www.example.com, OU=Web Hosting, O=Example LLC, L=Chicago, ST=Illinois, C=US.
  • Certificate Types
    • Email Certificates: SAN is an RFC 822 email address.
    • Code-Signing Certificates: Used to verify the publisher or developer of software and scripts. Do not use SAN but require CA validation of the organization.

Important terms

taken from the text above
Initial Use
Identified the FQDN of a server (e.g., www.comptia.org).
Deprecation
CN can contain various information, making it difficult for browsers to interpret correctly.
Subdomains
SAN can list specific subdomains (e.g., www.comptia.org, members.comptia.org) or use a wildcard domain (e.g., *.comptia.org) for all subdomains.
Email Certificates
SAN is an RFC 822 email address.
Code-Signing Certificates
Used to verify the publisher or developer of software and scripts. Do not use SAN but require CA validation of the organization.
DN Distinguished Name CN Common Name SAN Subject Alternative Name OU Organizational Unit ST State

Examples & real-world scenarios

Supplementary — not from your PDF
  • One certificate covering example.com and www.example.com via SAN.
  • A wildcard certificate for *.example.com.
  • Code-signing certificates that identify a software publisher.

Scenario

A company adds shop.example.com, but its certificate only lists www.example.com in the SAN. Visitors see a name mismatch warning until a new certificate with shop.example.com (or a wildcard) is issued.

Common mistakes

Supplementary — not from your PDF
  • Relying on the CN to match hostnames. Modern browsers check the SAN.
  • Forgetting that a wildcard covers only one level (*.example.com doesn't cover a.b.example.com).

Practical skills

Supplementary — not from your PDF
  • Pick SAN entries or a wildcard for a set of hostnames.

What I should remember

Key Points PDF p.62
  • Common Name (CN)
    • Deprecated: No longer reliable for FQDN validation.
    • Initial Use: Identified server FQDN.
  • Subject Alternative Name (SAN)
    • Identifiers: FQDNs, IP addresses.
    • Validation: Browsers validate SAN over CN.
    • Subdomains: Specific or wildcard.
  • Distinguished Name (DN)
    • Fields: O, OU, L, ST, C.
    • Example: CN=www.example.com, OU=Web Hosting, O=Example LLC, L=Chicago, ST=Illinois, C=US.
  • Certificate Types
    • Email Certificates: SAN as email address.
    • Code-Signing Certificates: Verify software publishers, require CA validation.