… if I may be very pedantic for a moment. > Having a Subject Name in general is common (although apparently not actually required) It depends on what you mean

… if I may be very pedantic for a moment. > Having a Subject Name in general is common (although apparently not actually required) It depends on what you mean by "required". A name (which a subjectName is) is a list of sets of key/value attributes; that list will always be present, but it might not have anything in it. (It might be the empty list.) (Whether you count a present, but empty, list as fulfilling the word "required", I leave up to you.) > See also, which pointed me to no-subject.labs.vu.nl, which has a currently valid TLS certificate with no Subject Name at all. It's there, and it's empty. The structure is: (read "SEQUENCE" here like "struct"; a list is closer to a "SEQUENCE OF") TBSCertificate ::= SEQUENCE { version [0] EXPLICIT Version DEFAULT v1, serialNumber CertificateSerialNumber, signature AlgorithmIdentifier, issuer Name, validity Validity, subject Name, subjectPublicKeyInfo SubjectPublicKeyInfo, If you use openssl to dump the ASN: 117:d=2 hl=2 l= 30 cons: SEQUENCE # validity 119:d=3 hl=2 l= 13 prim: UTCTIME :201017024909Z # start 134:d=3 hl=2 l= 13 prim: UTCTIME :210415215900Z # end 149:d=2 hl=2 l= 0 cons: SEQUENCE # subject 151:d=2 hl=4 l= 290 cons: SEQUENCE # subjectPublicKeyInfo So, it's "there", and we even spend a whole 2 bytes on it. I believe there's also some requirements on it being non-empty. The article's author is looking at it mostly from the point of view of leaf certs, and there, it can be empty. On CA certs, however, it can't be empty. (Because "Issuer" can't be empty on certs issued by the CA, and it must match the Subject of the CA cert, ergo, Subject must be non-empty there. Doesn't have to have a CN, though.) (All of this is in https://tools.ietf.org/html/rfc5280 https://tools.ietf.org/html/rfc5280) (But, yeah, like the article says, using CN for checking the domain is dead.)