search

kaikramer / keystore-explorer

KeyStore Explorer is a free GUI replacement for the Java command-line utilities keytool and jarsigner.
https://keystore-explorer.org/
GNU General Public License v3.0
1.7k stars 275 forks source link

Enhance the Subject string with proper case and naming of RDN's #514

Open JeroenPotNHG opened 1 month ago

JeroenPotNHG commented 1 month ago

I use keystore explorer to display information about certificates. I need to copy the subject string to use in our application. I noticed that some RDN's are numbers or in the wrong case. It would be great if this can be fixed.

So for example I have the following Subject: CN=acme.test.nl,O=Acme Inc.,ST=Amsterdam,C=NL,BusinessCategory=Private Organization,1.3.6.1.4.1.311.60.2.1.3=NL,SERIALNUMBER=123456

The issue is with: SERIALNUMBER, this should be serialNumber BusinessCategory, this should be businessCategory 1.3.6.1.4.1.311.60.2.1.3, this should be jurisdictionC

Is this something that can be fixed? I use v5.5.3 on windows 10 enterprise

kaikramer commented 1 month ago

The string representation of distinguished names is not as clear as you seem to believe it is. There are several different standards and additions and changes over time.

For example the Windows certificate viewer also shows attribute type "2.5.4.5" as "SERIALNUMBER".

I'll consider changing this to camel case in KSE for the next release, but cannot promise anything.

Regarding the OID "1.3.6.1.4.1.311.60.2.1.3": The following OIDs are currently not supported by KSE:

jurisdictionLocalityName (OID: 1.3.6.1.4.1.311.60.2.1.1) jurisdictionStateOrProvinceName (OID: 1.3.6.1.4.1.311.60.2.1.2) jurisdictionCountryName (OID: 1.3.6.1.4.1.311.60.2.1.3)

And if they were supported then probably with the name above, as this is how it's specified in https://cabforum.org/uploads/CA-Browser-Forum-EV-Guidelines-v1.7.2.pdf.

By the way, OID 1.3.6.1.4.1.311.60.2.1.3 is registered as "jurisdictionOfIncorporationCountryName": http://oidref.com/1.3.6.1.4.1.311.60.2.1.3 This was changed later to "jurisdictionCountryName", which is still different from the "jurisdictionC" that you were expecting.

JeroenPotNHG commented 1 month ago

Hi Kai,,

Thank you for the response. Live is never as easy as you hope for. We are unfortunately depending on an external supplier to extract the information from the certificates. I guess we have to live with it and remeber to use the proper case.

Anyway, I hope the camel case will make it for the next release.

And I love KSE by the way. At certificate changing times I use it a lot.