I thought we already had a bug about this, bug I cannot find it now.
RFC3280 says that a conforming implementations MUST recognize these name
distinguished name qualifier dnQualifier=
state/province name ST=
common name CN=
serial number ???
and SHOULD recognize these attribute types
given name ???
generation qualifier (jr, 3rd, etc.) ???
nss/lib/certdb/alg1485.c recognizes the attributes types shown above with
equal signs, and also the ones listed below. It does not recognize the
ones shown above with question marks. Additional ones recognized by
PKCS9 email address E=
RFC1274 UID UID=
RFC1274 email MAIL=
NSS's absent recognition of some of the above attribute types has already
been an issue for some NSS users. It should be easy to add the additional
types to alg1485.c. Let's do it.
The question is: what strings should be used to identify these new attribute
types in the RFC 1485-style srings?
I propose to use these strings for these OIDs:
"CN", 64, SEC_OID_AVA_COMMON_NAME
"ST", 128, SEC_OID_AVA_STATE_OR_PROVINCE
"OU", 64, SEC_OID_AVA_ORGANIZATIONAL_UNIT_NAME
"DC", 128, SEC_OID_AVA_DC
"C", 2, SEC_OID_AVA_COUNTRY_NAME
"O", 64, SEC_OID_AVA_ORGANIZATION_NAME
"L", 128, SEC_OID_AVA_LOCALITY
"dnQualifier", 32767, SEC_OID_AVA_DN_QUALIFIER
"E", 128, SEC_OID_PKCS9_EMAIL_ADDRESS
"UID", 256, SEC_OID_RFC1274_UID
"MAIL", 256, SEC_OID_RFC1274_MAIL
"SURNAME", 64, SEC_OID_AVA_SURNAME
"SERIAL", 64, SEC_OID_AVA_SERIAL_NUMBER
"STREET", 128, SEC_OID_AVA_STREET_ADDRESS
"TITLE", 64, SEC_OID_AVA_TITLE
"ADDRESS", 128, SEC_OID_AVA_POSTAL_ADDRESS
"CODE", 40, SEC_OID_AVA_POSTAL_CODE
"BOX", 40, SEC_OID_AVA_POST_OFFICE_BOX
"GIVEN", 64, SEC_OID_AVA_GIVEN_NAME
"INITIALS", 64, SEC_OID_AVA_INITIALS
"GENERATION", 64, SEC_OID_AVA_GENERATION_QUALIFIER
"HOUSE", 64, SEC_OID_AVA_HOUSE_IDENTIFIER
"AKA", 64, SEC_OID_AVA_PSEUDONYM
If anyone has any better suggestions, please set them forth here.
Created attachment 125057 [details] [diff] [review]
Augment name attribute table, eliminate duplication
This patch adds the new attribute types and strings shown above to the table.
It also adds a new column to the table, which contains the maximum permitted
length of an attribute of that type.
It removes several switch statements that duplicated information that is in
the table, and uses the value in the table instead.
It also removes some dead old code that was #if 0.
Created attachment 125066 [details] [diff] [review]
patch, part 2, prerequisite to patch above.
attachment 125057 [details] [diff] [review] depends on these changes to the table of known SEC OIDs.
The above patches were checked in on the trunk on June 6.
I left the bug open because I wasn't completely convinced that the new
"short names" introduced by this patch were the right ones. There was
not a clear consensus among IETF documents about this, and still is not,
So, I will mark this fixed, with the understanding that we may need to
revisit this if/when the IETF standardizes short names for some of these.
Also, I have heard that OpenSSL has established short names for some of
these. Our table probably should recognize OpenSSL's short names.