Re: [pkix] Syntax of Subject Alternative Names field in a certificate

You're right that its a question for another list but the disjoin
between ASN.1 and OID on the one hand, and presentation format and
input in .config  tooling on the other hand is very strong here.

In times past IETF has engaged in specifying things which strictly
have nothing to do with on-the-wire bit sequences. sockets related
stuff for instance. It's not common, and I don't think this fits the
bill, but the problem is real:

people get confused about presentation format and encoding.

-G

On Wed, Apr 17, 2024 at 1:52 AM Michael StJohns <msj@nthpermutation.com> wrote:
>
> Hi Andreas -
>
> You appear to be asking about how to make Openssl issue a cert with an SAN.  That's not a topic for this list.
>
> This list is about IETF standards in the Public Key Infrastructure field of use.  If you have a question about the ASN1 that goes into making an SAN OtherName, that would be more appropriate for this list.
>
> I'd suggest referring your questions to the OpenSSL community, or going to the repository and reading the code directly.
>
> Good luck - Mike
>
>
>
>
>
>
> On 4/16/2024 8:12 AM, Andreas Maier wrote:
>
> Hi, I am trying to understand what the syntax is for the string value of the Subject Alternative Names field, particularly when it contains multiple entries.
>
> I was hopeful to find that in https://datatracker.ietf.org/doc/html/rfc5280 which as a section 4.2.1.6 “Subject Alternative Name” but I could not get that out of the syntax description in there.
>
> I can find examples which seem to suggest it is a comma-separated list of items, each of which has a type indicator (e.g. “DNS”), as in:
>
> DNS:{hostname1},IP:{ip2},email:{email},URI:{uri4}
>
> Some sources for the examples:
>
> https://www.openssl.org/docs/man1.0.2/man5/x509v3_config.html
> https://support.hpe.com/hpesc/public/docDisplay?docId=sf000094754en_us&docLocale=en_US&page=index.html
> https://www.linode.com/docs/guides/using-openssls-subjectaltname-with-multiple-site-domains/ use:
>
> Where is the syntax of the Subject Alternative Names field documented in an RFC?
> Are the type indicators mandatory or optional?
>
>
>
> Kind regards,
>
> Andy
>
>
> _______________________________________________
> pkix mailing list
> pkix@ietf.org
> https://www.ietf.org/mailman/listinfo/pkix
>
>
> _______________________________________________
> pkix mailing list
> pkix@ietf.org
> https://www.ietf.org/mailman/listinfo/pkix