notaryproject / specifications

Cross tooling and interoperability specifications
https://notaryproject.dev/
Apache License 2.0
155 stars 44 forks source link

Support x509 subject with RDN state/province using short name "S" #287

Closed yizha1 closed 1 month ago

yizha1 commented 9 months ago

The current trust policy and store specification has constraints on x509 subject DN. The state or province RDN need to be ST=xxx, for example ST=Washington, however S= is also an acceptable short name. If users set x509 subject DN with S=xxx, the trust policy will fail with the following error:

Error: trust policy statement "mypolicy" has trusted identity "x509.subject: xxxxxx" with invalid identity value: distinguished name (DN) "xxxxxx" has no mandatory RDN attribute for "ST", it must contain 'C', 'ST', and 'O' RDN attributes at a minimum

This issue is to ask for the support of state/province RDN with short name S.