Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 740 / 840

Standard X.509 v3 Certificate Extensions
740 Red Hat Certificate System Administrator’s Guide • September 2005
subjectAltName
OID
2.5.29.17
Criticality
If the certificate’s subject field is empty, this extension must be marked critical.
Discussion
The Subject Alternative Name extension includes one or more alternative (non-X.500)
names for the identity bound by the CA to the certified public key. It may be used in
addition to the certificate’s subject name or as a replacement for it. Defined name forms
include Internet electronic mail address (SMTP, as defined in RFC-822), DNS name, IP
address, and uniform resource identifier (URI).
PKIX requires this extension for entities that are identified by name forms other than the
X.500 distinguished name (DN) used in the subject field. PKIX Part 1 describes additional
rules for the relationship between this extension and the subject field.
Email addresses may be provided either in the Subject Alternative Name extension, the
certificate subject name field, or both. If the email address is provided as part of the subject
name, it must be in the form of the
EmailAddress
attribute defined by PKCS-9. Software
that supports S/MIME must be able to read an email address from either the Subject
Alternative Name extension or from the subject name field.
CS Version Support
Supported since CS 4.1. Refer to “SubjectAltNameExt” on page 535.
subjectDirectoryAttributes
OID
2.5.29.9
Criticality
PKIX Part 1 requires that this extension be marked noncritical.
Discussion
The Subject Directory Attributes extension conveys any desired directory attribute values
for the subject of the certificate. It is not recommended as an essential part of the proposed
PKIX standard, but may be used in local environments.
CS Version Support
Supported since CS 4.2. Refer to “SubjectDirectoryAttributesExt” on page 538.