Re: FQDN goes in commonName or domainComponent?

[Brian Korver <briank@briank.com>]

Niklas Hallqvist wrote:
> 
> I have no idea, but as an implementor, I have used it in a few
> semi-official projects when looking up certificate chains in DNS
> (using DNSSEC of course); isakmpd, konqueror and lynx.  I'd expect
> anyone wanting to do the same would have found the info in the
> suitable standard documents.  I preferred dNSName in subjectAltName,
> had DC as ary choice, and as fallback, CN.  I had no idea CN would be
> *more* standard than DC.  How are you to find that out?  It seemed
> more ad-hoc to me.
> 
> Niklas

It's more-or-less standard in several protocols (SSL for instance),
but I didn't mean standard in the sense of appearing in some
document (although that might be true too).

The issue isn't whether to use subjectAltName.  That is the right thing
to do.  The issue is:  if someone is going to place a domain name in
SubjectName (perhaps because it's a v1 certificate? :), then what
attribute should be used?

-brian
briank@briank.com