SSL Certificate – Required Fields in a Web Server SSL Certificate

ssl-certificate

I am learning about SSL certificates and doing some testing with a web server on my machine. I am trying to understand which field are required to be in the server certificate in order to be accepted by the browser. So far I came to this conclusions.

Certificate contains this information

  • Version and serial number.
  • Information about the issuer: country, state, city, organization, organization unit common name, email.
  • Validity: not before date, not after date.
  • Information about the the subject: country, state, city, organization, organization unit, common name, email.
  • Subject public key: algorithm, length, key.
  • Other information (extensions), like subject alternative name for example.

What is required

  • The certificate has to be signed by a trusted CA.
  • The Common Name of the subject has to be present and correspond to the domain name of the site.
  • A certificate can be valid for multiple hostnames, in which case they have to be specified in the Subject Alternative Name extension. Some browsers require this extension to be present in the certificate.
  • The validity date has to be valid and therefore can not be empty

Best Answer

One good place place to look for these details is in the CA Browser https://cabforum.org/ forum baseline requirements document.

The details for all certificates involved can be found in section 7.