3 ms·

Just to expand on this, commonName is not at all required in certificates and is basically deprecated/legacy Letsencrypt does not require you to set it, just s

Just to expand on this, commonName is not at all required in certificates and is basically deprecated/legacy Letsencrypt does not require you to set it, just subject alternate names, which can be up to 255 characters, but some providers require it for no reason

semi 2y ago
surprisingly it's been deprecated since RFC 2818 was published 24 years ago. It's only more recently that browsers and other common software stopped validating it though
- throw0101c 2y ago
  If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead. * https://datatracker.ietf.org/doc/html/rfc2818#section-3.1 https://datatracker.ietf.org/doc/html/rfc2818#section-3.1 Therefore, if and only if the presented identifiers do not include a DNS-ID, SRV-ID, URI-ID, or any application-specific identifier types supported by the client, then the client MAY as a last resort check for a string whose form matches that of a fully qualified DNS domain name in a Common Name field of the subject field (i.e., a CN-ID). If the client chooses to compare a reference identifier of type CN-ID against that string, it MUST follow the comparison rules for the DNS domain name portion of an identifier of type DNS-ID, SRV-ID, or URI-ID, as described under Section 6.4.1, Section 6.4.2, and Section 6.4.3. * https://www.rfc-editor.org/rfc/rfc6125#section-6.4.4 https://www.rfc-editor.org/rfc/rfc6125#section-6.4.4 Also from 2015: 9.2.2 Subject Distinguished Name Fields a. Subject Common Name Field Certificate Field: subject:commonName (OID 2.5.4.3) Required/Optional: Deprecated (Discouraged, but not prohibited) Contents: If present, this field MUST contain a single IP address or Fully-Qualified Domain Name that is one of the values contained in the Certificate’s subjectAltName extension (see Section 9.2.1). * https://cabforum.org/wp-content/uploads/BRv1.2.5.pdf#page=17 https://cabforum.org/wp-content/uploads/BRv1.2.5.pdf#page=17 * https://stackoverflow.com/questions/5935369/how-do-common-names-cn-and-subject-alternative-names-san-work-together https://stackoverflow.com/questions/5935369/how-do-common-na...
layer8 2y ago
To further expand, commonName is only deprecated for SSL/TLS server certificates. It is, for example, mandatory for CA certificates and code signing certificates.

semi 2y ago

surprisingly it's been deprecated since RFC 2818 was published 24 years ago. It's only more recently that browsers and other common software stopped validating it though

throw0101c 2y ago
If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead. * https://datatracker.ietf.org/doc/html/rfc2818#section-3.1 https://datatracker.ietf.org/doc/html/rfc2818#section-3.1 Therefore, if and only if the presented identifiers do not include a DNS-ID, SRV-ID, URI-ID, or any application-specific identifier types supported by the client, then the client MAY as a last resort check for a string whose form matches that of a fully qualified DNS domain name in a Common Name field of the subject field (i.e., a CN-ID). If the client chooses to compare a reference identifier of type CN-ID against that string, it MUST follow the comparison rules for the DNS domain name portion of an identifier of type DNS-ID, SRV-ID, or URI-ID, as described under Section 6.4.1, Section 6.4.2, and Section 6.4.3. * https://www.rfc-editor.org/rfc/rfc6125#section-6.4.4 https://www.rfc-editor.org/rfc/rfc6125#section-6.4.4 Also from 2015: 9.2.2 Subject Distinguished Name Fields a. Subject Common Name Field Certificate Field: subject:commonName (OID 2.5.4.3) Required/Optional: Deprecated (Discouraged, but not prohibited) Contents: If present, this field MUST contain a single IP address or Fully-Qualified Domain Name that is one of the values contained in the Certificate’s subjectAltName extension (see Section 9.2.1). * https://cabforum.org/wp-content/uploads/BRv1.2.5.pdf#page=17 https://cabforum.org/wp-content/uploads/BRv1.2.5.pdf#page=17 * https://stackoverflow.com/questions/5935369/how-do-common-names-cn-and-subject-alternative-names-san-work-together https://stackoverflow.com/questions/5935369/how-do-common-na...

layer8 2y ago

To further expand, commonName is only deprecated for SSL/TLS server certificates. It is, for example, mandatory for CA certificates and code signing certificates.