2
$\begingroup$

This is a CN from a x509 certificate (I have done some substitutions just to mask the data but the length is not changed)

CN=Alex Perry/pseudonym=88b2e76beE0e4e4b94b502020202262E/x500UniqueIdentifier=22e4EE844E8B744490EEE96EE8BEB7E29548e4496E425247944B025E04528654/postalCode=60601

As per the RFC, the CN field should not be more than 64 bytes, but this CN is more than 64 bytes

So does the max length 64 only counted up for the CN=Alex Perry & the rest of the string (/pseudonym, /x500UniqueIdentifier etc) is ignored?

If so, is there a limit imposed on the total maximum length? What is that?

$\endgroup$
1
$\begingroup$

They are separate fields. Their lengths, from the very same RFC:

ub-pseudonym INTEGER ::= 128

ub-postal-code-length INTEGER ::= 16

If x500UniqueIdentifier is OID 2.5.4.45 then it is a bit-string which isn't constrained in length (afaik).

Both the Subject and the Issuer fields are instances of RelativeDistinguishedName (section 4.1.2.4) and are of SIZE (1..MAX)

Appendix B says that:

MAX indicates that the upper bound is unspecified. Implementations are free to choose an upper bound that suits their environment.

So while the definition suggests that Subject can be as large as you want it to be, it also suggests that it may well be constrained by your particular implementation.

$\endgroup$
  • $\begingroup$ Is there any upper limit for the who Subject field combined? $\endgroup$ – user93353 Dec 22 '17 at 12:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.