Subject: RFC 3280 and multiple Organization (O) fields in DN

From: Jostein Tveit <[email-masked]>
Date: Wed, 22 Dec 2004 12:47:58 +0100

Hello pkix list!

I have a question regarding RFC 3280 and support for multiple
Organization (O) fields in the DN field in a certificate.

A can not see that the standard says anything explicit about
this.
Can someone please guide me to where I can find some information
about this issue, or point out the section I missed in the RFC.

Basically, is multiple Organization (O) fields allowed?
And where is it stated/not stated?

Thanks in advance for all answers.

Regards,
-- 
Jostein Tveit <[email-masked]>

---

From: Stephen Kent <[email-masked]>
Date: Wed, 22 Dec 2004 08:00:05 -0500

>Thanks in advance for all answers.

This is an X.500/X.520 question, more than an X.509/PKIX question.

However, my answer in that one would not expect to see multiple 
organization attributes in a DN, although multiple organizational 
unit attributes are fine.  It's a matter of the semantics of DNs and 
the interpretation of attributes.  Similarly, one would not expect to 
see multiple country attributes in a DN, in the usual interpretation 
of the DIT.

Steve

---

From: Russ Housley <[email-masked]>
Date: Wed, 22 Dec 2004 09:13:04 -0500

This is part of the X.500 distinguished name.  It does not prohibit any of 
the attributes from appearing more than once.  Early versions of the CCITT 
(wkich is now called ITU-T) included an informative state machine about 
name construction.  So many people took the state machine as normative that 
it was dropped from the later versions of the document to avoid confusion.

Russ

---

From: [email-masked] (Peter Gutmann)
Date: Thu, 23 Dec 2004 23:40:08 +1300

Russ Housley <[email-masked]> writes:

>Early versions of the CCITT (wkich is now called ITU-T) included an
>informative state machine about name construction.

"Informative"?  I've always used that state machine as an example of the fact
that even the standards authors had no idea how a DN should be arranged.  So I
guess it is informative, but it's conveying an entirely different message than
was originally intended.

Peter.

---

From: Tom Gindin <[email-masked]>
Date: Thu, 23 Dec 2004 11:46:41 -0500

IMHO, this rule originated with X.400.  The name form containing 
C, O, OU, and CN is largely derived from the "Mnemonic O/R address" of 
CCITT (now ITU) X.400, although in that standard there was also a 
mandatory administrative domain name.  In that standard, C, O, and CN had 
to be single-valued, while OU could have up to four values (see the 
MTSUpperBounds ASN.1 module).
        I don't see anything in the directory standards proper (especially 
X.520 and X.521, where it would be expected) which is as clear as X.400 in 
forbidding multiple values of C and O while permitting them for OU.

                Tom Gindin

Stephen Kent <[email-masked]>
Sent by: [email-masked]
12/22/2004 08:00 AM
 
        To:     Jostein Tveit <[email-masked]>
        cc:     [email-masked]
        Subject:        Re: RFC 3280 and multiple Organization (O) fields 
in DN

Steve

---

From: Stephen Kent <[email-masked]>
Date: Thu, 23 Dec 2004 14:09:39 -0500

>forbidding multiple values of C and O while permitting them for OU.

I think the semantics of the attributes support the notion of one 
instance for C and O, but multiple instances of OU.

Steve