# Does maximum length of CN in a x509 cert include the length of the OIDs?

This is a CN from a x509 certificate (I have done some substitutions just to mask the data but the length is not changed)

CN=Alex Perry/pseudonym=88b2e76beE0e4e4b94b502020202262E/x500UniqueIdentifier=22e4EE844E8B744490EEE96EE8BEB7E29548e4496E425247944B025E04528654/postalCode=60601

As per the RFC, the CN field should not be more than 64 bytes, but this CN is more than 64 bytes

So does the max length 64 only counted up for the CN=Alex Perry & the rest of the string (/pseudonym, /x500UniqueIdentifier etc) is ignored?

If so, is there a limit imposed on the total maximum length? What is that?

They are separate fields. Their lengths, from the very same RFC:

ub-pseudonym INTEGER ::= 128

ub-postal-code-length INTEGER ::= 16

If x500UniqueIdentifier is OID 2.5.4.45 then it is a bit-string which isn't constrained in length (afaik).

Both the Subject and the Issuer fields are instances of RelativeDistinguishedName (section 4.1.2.4) and are of SIZE (1..MAX)

Appendix B says that:

MAX indicates that the upper bound is unspecified. Implementations are free to choose an upper bound that suits their environment.

So while the definition suggests that Subject can be as large as you want it to be, it also suggests that it may well be constrained by your particular implementation.

• Is there any upper limit for the who Subject field combined? – user93353 Dec 22 '17 at 12:44