Re: distinguished name order

On Wed, Jul 30, 2025 at 11:23:39PM +0000, Mike wrote:

> > > I'm finding that Golang's crypto/x509 library comes up short in
> > > recognizing certain critical-marked extensions.  (IDK which ones yet.  Using
> > > trail and error to find out.)
> > 
> > So...`email`, `DNS` and `IP` are all understood by Golang, the mythical
> > `dirName` is not.
> 
> This was in Helm 3.18.4, which uses Go 1.24.4.  This probably sums it up:
> <https://go.dev/src/crypto/x509/x509.go#L1052>

The relevant code starts at:

    https://go.dev/src/crypto/x509/verify.go#L647

Go only bothers with names in SANs, there is no longer any support for
names in the CN (or other) element of the DN, and no DN constraints are
implemented.  This is by now quite reasonable.

Bottom line, in an X.509 context the order of subject DN components is a
private matter for the issuer, and only matters to the extent that the
subject is itself a CA, and then that name has to be copied verbatim
into the issuer field of its issued certificates.

However, if one is maintaining an LDAP directory, then the order of DN
components matters in searchBase specifications and chasing indirect
references.

This being an OpenSSL (rather than an LDAP) users list, the take away is
that any order is fine, so long as it is used *consistently*.  The
legacy presentation form matches the "wire" ASN.1 sequence form, and
some day in the not too distant future OpenSSL may switch to RFC4514
(LDAP) presentation form, which reverses the order, uses commas as
separators, and should have more reliable "round-trip" behaviour.

The legacy form will continue to be recognised in the "-subj" option.

-- 
    Viktor.  🇺🇦 Слава Україні!

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/aIrwg-T-7TulkuLq%40chardros.imrryr.org.