X.509证书中的专有名称长度约束 [英] Distinguished Name length constraint in X.509 certificate

问题描述

在

In the common name field of the DN of a X509 certificate, as defined in ASN.1 notation for OID "2.5.4.3", the limit is up to 64 characters. Is there any turnaround if we want to have a common name of more than 64 characters?

推荐答案

即使您可以哄骗证书生成代码以拥有更长的CN，也需要更改 clients 大多数您无法控制.客户很可能会拒绝CN太长的证书，然后您根本没有证书.

Even if you could cajole your certificate generation code to have a longer CN, it's also the clients that will need to change, of which most you have no control over. Clients could well reject a certificate with a too-long CN and then you'll have no certificate at all.

如评论中所述，您可以(并且应该)将该域名和其他域名放入使用者备用名称"扩展名中，并将CN留空.不是整个主题"，而是它的CN部分.

As mentioned in the comments, you can (and should) put that and other domain names into the Subject Alternate Name extension and leave the CN empty. Not the whole "Subject", but just the CN part of it.

这篇关于X.509证书中的专有名称长度约束的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！