SSL/TLS protocol overview

AN4683

8/31

DocID027745 Rev 1

X.509 system, the subject of the certificate is identified by a distinguished name (DN). A DN

is a series of name-value pairs that uniquely identify an entity. The following attribute types

are commonly found in the DN:

The X.509 standard provides for a DN to be specified in a string format. For example:

CN=John, O=STM, OU=Test, C=IT

The common name (CN) can describe an individual user or any other entity, for example a

web server. DNs may include a variety of other name-value pairs. The rules governing the

construction of DNs can be complex. For comprehensive information about DNs (see [8] in

References).

In this model of trust relationships, a certification authority (CA) is an independent and

trusted third party that issues digital certificates to provide assurance that the public key of

an entity truly belongs to that entity. The roles of a CA are:

–

On receiving a request for a digital certificate, to verify the identity of the requester

before building, signing and returning the personal certificate

–

To provide the CA’s own public key in its CA certificate

–

To publish lists of certificates that are no longer trusted in a certificate revocation

List (CRL).

An X.509 certificate issued by the CA binds a particular public key to the name of the DN the

certificate identifies. Only the public key certified by the certificate will work with the

corresponding private key possessed by the DN identified by the certificate.

CN

Common name

T

Title

O

Organization name

OU

Organization unit name

L

Locality name

ST (or SP or S)

State or province name

C

Country