Home / server / Questions / 593753
Accepted
Dustin Oprea
Asked: 2014-05-08 11:51:00 +0800 CST

Issuer Subject Policy in Self-Signed CA Certificate

  • 772

When I build a self-signed certificate for an internal CA, should I make the issuer DN match the DN in the request, should they be different, or is there no convention for one or the other?

ssl

1 Answers

  1. Best Answer

    Here are the definitions from RFC 5280 (Setion 3.2):

       Self-issued certificates are CA certificates in which
   the issuer and subject are the same entity.  Self-issued certificates
   are generated to support changes in policy or operations.  Self-
   signed certificates are self-issued certificates where the digital
   signature may be verified by the public key bound into the
   certificate.  Self-signed certificates are used to convey a public
   key for use to begin certification paths.

    So yes, by definition, since a self-signed certificate is a specific self-issued certificate, its Issuer DN must match its Subject DN.

    (Whether this Subject DN needs to be in the CSR is a different matter since (a) CAs don't have any obligation to keep the exact Subject DN when turning a CSR into a cert (in fact they ought to check everything they put into a cert by another means) and (b) the steps that turn a CSR into a self-signed cert have more to do with how openssl is used for this and how it is configured. That's really just a detail.)

    Whether you want your own CA to be self-signed or self-issued is for you to choose. It generally makes sense to do so (at least for clarity). In principle, CA certificates used as trust anchors by your remote parties don't have to be self-signed (see section 6):

       The selection of a trust anchor is a matter of policy: it could be
   the top CA in a hierarchical PKI, the CA that issued the verifier's
   own certificate(s), or any other CA in a network PKI.  The path
   validation procedure is the same regardless of the choice of trust
   anchor.
    • 2