A general digital certificate issued by a CA might contain information about the individual/organization to whom the certificate belongs. As an example, consider this sample scenario:

Sample PKC

This PKC contains identifying information of the individual to whom is this certificate is issued, i.e. the Name (Mario Rossi), Organization (Wikimedia), and so on. For a more concrete example, here is an excerpt of the PKC data issued to Wikimedia, containing info about their company name, address and domain:

Subject: C=US, ST=California, L=San Francisco, O=Wikimedia Foundation, Inc., CN=*.wikipedia.orgSubject 

My question is what are the standards used by the CA to ensure that these claimed details about the Subject's name, address, domain, etc are genuine and not being falsely claimed by forger? Additionally, what kind of subject-related-data, in addition to names, addresses, etc., can be expected to be verfied by the CA?

  • 3
    $\begingroup$ Arguably, this question is more on-topic for security-SE. Have a look at these, e.g. this, this. $\endgroup$
    – fgrieu
    Dec 12 '20 at 9:08
  • $\begingroup$ Actually this is part of what a Registration Authority does. An RA can be role within a CA, but it might also delegate the operation. $\endgroup$
    – Maarten Bodewes
    Dec 12 '20 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.