Subject: [pkix] issuing a certificate from a signing request

From: "Dan Harkins" <[email-masked]>
Date: Mon, 22 Apr 2013 14:59:43 -0700 (PDT)

Hello,

  Is a CA obligated to issue a certificate using the subjectName that is in
a certificate signing request or can it modify, update, and change the
subjectName in the CSR and issue any certificate it wants?

  Let's say I generate a CSR with "CN=dharkins" but the CA wants my
certificate to have "CN=Daniel Harkins" or even "CN=Employee428".
Is it allowed to issue such a certificate in response to my signing request
or must it use what I sent in the CSR?

  I was unable to find an answer to this question in any RFC or any
standard issued by another SDO. If anyone knows a definitive answer
to this and can point to a published standard I would greatly appreciate
it.

  thanks,

  Dan.

---

From: Michael Jenkins <[email-masked]>
Date: Mon, 22 Apr 2013 18:34:26 -0400

Dan,

there isn't any definitive technical answer. The naming section of a CP is
always the PITA-est part to write.

I suppose canonically, this is the purview of an RA, but RAs are now
essentially CA-bots. Or the other way around, I can never tell.

The CA is vouching authoritatively for the contents of the certificate, so
in some sense the CA can do what it pleases about the contents, or not
issue if it's in doubt. Naturally, a signing-bot won't do that. And if
you're paying for the cert, the CA is going to lose business if it doesn't
go ahead and sign whatever you tell it to. Also, if you're running an
enterprise RA for which the CA is cert-manufacturing, the CA won't do much
second-guessing (but ought to be anomaly checking for just in case). That
scenario would hopefully be covered by a contract, anyway. So it *really*
depends on your application, client, and architecture.

Hope that helps. Well, hope it didn't make it any worse :)

Mike Jenkins

On Mon, Apr 22, 2013 at 5:59 PM, Dan Harkins <[email-masked]> wrote:

> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix
>

---

From: Santosh Chokhani <[email-masked]>
Date: Tue, 23 Apr 2013 09:47:09 -0400

Dan,

I tend to agree with Mike.

A CA for sure must not simply respect a CSR unless it has been vetted (including the requested Subject DN) by the CA or a party the CA trusts such as an RA.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Michael Jenkins
Sent: Monday, April 22, 2013 6:34 PM
To: Dan Harkins
Cc: [email-masked]
Subject: Re: [pkix] issuing a certificate from a signing request

Dan,

there isn't any definitive technical answer. The naming section of a CP is always the PITA-est part to write.

I suppose canonically, this is the purview of an RA, but RAs are now essentially CA-bots. Or the other way around, I can never tell.

The CA is vouching authoritatively for the contents of the certificate, so in some sense the CA can do what it pleases about the contents, or not issue if it's in doubt. Naturally, a signing-bot won't do that. And if you're paying for the cert, the CA is going to lose business if it doesn't go ahead and sign whatever you tell it to. Also, if you're running an enterprise RA for which the CA is cert-manufacturing, the CA won't do much second-guessing (but ought to be anomaly checking for just in case). That scenario would hopefully be covered by a contract, anyway. So it *really* depends on your application, client, and architecture.

Mike Jenkins

On Mon, Apr 22, 2013 at 5:59 PM, Dan Harkins <[email-masked]<mailto:[email-masked]>> wrote:

  Hello,

  thanks,

  Dan.

_______________________________________________
pkix mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/pkix