# Is Common Name encoded in the certificate?

When I make a certificate like so

cd /etc/openvpn/easy-rsa/2.0/
source ./vars
. /etc/openvpn/easy-rsa/2.0/build-key client1


Then commonName is set to client1.

When I ask the OpenVPN server what the commonName is of the user who is connected, can I then trust, that the user haven't altered his commonName in the certificate?

Update

I have tried to change all the clear text in the crt file on both the client and server, but the certificate still works and the OpenVPN server still replies with the proper commonName and Subject.

This certificate still works, where I have altered all plain text. I have removed the actual certificate for security reasons.

If commonName and Subject isn't extracted from the plain text. Where does OpenVPN then gets them from?

Certificate:
Data:
Version: 3 (0x2)
Serial Number: 5 (0x5)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=X, ST=X, L=X, O=X, OU=X, CN=X CA/name=X/emailAddress=X@X.X
Validity
Not Before: Jan 12 12:53:47 2012 GMT
Not After : Apr 11 12:53:47 2012 GMT
Subject: C=X, ST=X, L=X, O=X, OU=X, CN=X/emailAddress=X@X.X
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:a5:40:a0:e4:44:3e:27:4c:13:69:03:a7:c3:38:
4f:dc:43:dc:fb:f5:43:c8:5b:50:8b:7f:0d:f4:d8:
30:00:e0:e3:f7:75:1c:3b:e2:08:95:8e:31:cf:a7:
6f:e2:94:f4:4d:7c:c4:11:a9:a5:84:1b:95:2b:9a:
93:da:ad:34:ae:df:5d:9d:0a:18:b3:df:86:c1:f6:
fb:fe:d8:16:64:a9:bf:91:51:8a:54:ba:26:5a:b4:
6a:88:c3:52:a7:fa:86:39:08:20:c1:53:3d:f3:12:
e1:50:37:11:16:db:99:53:02:82:6f:a0:05:9f:23:
ff:bf:79:93:1c:ef:1e:4e:31
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
Easy-RSA Generated Certificate
X509v3 Subject Key Identifier:
89:E7:7A:9B:1F:72:15:91:BD:D0:F4:67:A8:A1:C3:E0:0D:B1:3A:B3
X509v3 Authority Key Identifier:
keyid:75:A6:F1:68:88:53:F5:9B:14:4A:67:00:0B:58:7C:38:1C:A0:A1:F8
DirName:/C=X/ST=X/L=X/O=X/OU=X/CN=X CA/name=X/emailAddress=X@X.X
serial:80:D1:56:33:4C:5D:6D:57

X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Key Usage:
Digital Signature
Signature Algorithm: sha1WithRSAEncryption
9c:a5:2b:a8:cf:86:60:90:f3:45:80:78:30:89:6a:56:cc:09:
e8:a4:75:25:af:04:52:8f:15:7b:cd:87:94:f3:c4:2f:99:3f:
b5:51:f7:e1:de:96:92:ae:0a:77:9e:1f:fb:8a:c3:de:84:3c:
bb:4f:7f:f1:67:af:0c:1e:b0:90:2c:de:63:f8:47:89:f5:7b:
57:fe:e4:8d:1d:1e:62:19:27:99:83:99:9f:4d:08:ef:b6:b4:
7d:56:5d:ca:39:fd:1c:f3:15:6a:da:bc:51:ca:ad:59:7c:af:
77:72:3c:ca:e7:dc:74:bc:c0:de:2e:f7:b2:27:1b:a7:ae:02:
0f:9c
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

-
add comment

## 2 Answers

The plain text at the beginning of your crt file is there for informational purposes only. All it does is present in human readable form the contents of the Base64 encoded certificate that follows. The informational text is ignored by most PKI software.

-
add comment

The "Common Name" is part of a X.500 name; here, the one called "SubjectDN", which designates the owner of the public key which is contained in the certificate. That name is part of the certificate, in the part which is covered by the signature; as such, it is exactly as trustworthy as any other element in the certificate.

-
Very interesting. I have tried to change all plain text, but the certificate still works and OpenVPN still reports the correct commonName and Subject. How can that be? –  Sandra Schlichting Feb 10 '12 at 21:43
add comment