[pkix] Syntax of Subject Alternative Names field in a certificate

[Andreas Maier <[e-mail]>]

Hi, I am trying to understand what the syntax is for the string value of the Subject Alternative Names field, particularly when it contains multiple entries.

I was hopeful to find that in https://datatracker.ietf.org/doc/html/rfc5280 which as a section 4.2.1.6<https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.6> “Subject Alternative Name” but I could not get that out of the syntax description in there.

I can find examples which seem to suggest it is a comma-separated list of items, each of which has a type indicator (e.g. “DNS”), as in:

DNS:{hostname1},IP:{ip2},email:{email},URI:{uri4}

Some sources for the examples:

  *   https://www.openssl.org/docs/man1.0.2/man5/x509v3_config.html
  *   https://support.hpe.com/hpesc/public/docDisplay?docId=sf000094754en_us&docLocale=en_US&page=index.html
  *   https://www.linode.com/docs/guides/using-openssls-subjectaltname-with-multiple-site-domains/ use:
Where is the syntax of the Subject Alternative Names field documented in an RFC?
Are the type indicators mandatory or optional?

Kind regards,
Andy