Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

commonName deprecated for certificate issuance, use altNames instead #85

Closed
thebitrock opened this issue Feb 21, 2024 · 2 comments
Closed

Comments

@thebitrock
Copy link

https://github.com/publishlab/node-acme-client/blob/master/examples/dns-01/dns-01.js#L45-L48

commonName limited with 63 symbols
altName - 255 characters (237 symbols for dns-01 - due to the challenge prefix)

https://letsencrypt.org/docs/glossary/

  • Common Name (CN) : Part of a certificate’s Subject describing what the certificate is about. For roots and intermediates it’s the human-readable name of the certificate authority. For leaf certificates it’s one of the domain names on the certificate. Note: The common name is limited to 63 characters. It is an obsolete method of indicating a domain name to which the certificate applies, since current Internet standards expect software to check only the Subject Alternative Names in order to determine the applicability of a certificate.

https://www.redhat.com/en/blog/details-on-https-common-name-deprecation-in-openshift-4.10

  • x509: certificate relies on legacy Common Name field, use SANs instead

https://cabforum.org/uploads/BRv1.2.3.pdf

9.2.2 Subject Common Name Field
Certificate Field: subject:commonName (OID 2.5.4.3)
Required/Optional: Deprecated (Discouraged, but not prohibited)
Contents: If present, this field MUST contain a single IP address or Fully-Qualified Domain Name that is one of
the values contained in the Certificate’s subjectAltName extension (see Section 9.2.1).

@thebitrock
Copy link
Author

right way

        const [key, csr] = await acme.crypto.createCsr({
            altNames: [
                 WILDCARD_DOMAIN, 
                 `*.${WILDCARD_DOMAIN}`
            ]
        });

@nmorsman
Copy link
Contributor

Thanks for raising this, bug in auto() with no common name fixed in 9e277b5, docs and examples in 12f8096.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants