what CAcert does with the "Subject" and "SubjectAlternativeName" record in the issued X.509 certificate.
</p>
<p>
The ITU-T Recommendation X.509 of June 1997 (limited by the used OpenSSL implementation) defines the information types (and formats) "Tagged Modules" for the "Subject" (IETF standard RFC3280/4.1.2.6) for
a Distinguished Name (DN): a sequence of X.501 styled elements (type/value pairs),
type="value" (e.g. "CN=Saskia the Mystical/emailAddress=sky@limit.net") on the issued certificate (see for "type" below).
<p>
</p>
<p>
Subject and SubjectAlternativeName may be used in the Certificate Signing Request (CSR) sent to CAcert.
CAcert will use this information as well information checked from assurances and other means to assemble the Subject and SubjectAlternativeName records.
</p>
<P>
Other documents: RFC 3039 Qualified Certificate Profile.
</p>
<h2>
1. Information Policies
</h2>
<h3>
1.1 Organisation and Individual certificate information policy
</h3>
<p>
The current policy of CAcert on information of individuals and organisations on an issues certificate by CAcert is:
only those (exact) names and other information which are checked via
an assurance or by well defined means (e.g. email address and domain evaluation).
This is pretty much limited by reasons of private information
and traceability information.
The set of information about the certficate user on the issued certificate is
limited and shall meet common usage security practice on internet.
</p>
<h3>
1.2 Information Assurance
</h3>
<p>
CAcert operation will be organised such that the individual or
organisation Member of the CAcert Community for which the certificate is
issued has been identified by the web of trust of CAcert Assurers (Assurance Policy).
Prerequisite is: what is supplied as information on the issued
certificate should be well defined and it should be clear what is check
by assurances (or other means) and what not.
</p>
<h3>
1.3 Information and Internet Security Practice
</h3>
<p>
CAcert should not violate common security practice of the use of some
"type" - records in the Subject field in the issued certificate.
Here we talk about two types of certificates (key usage): server certificates and
client certificates for individuals (persons) and for organisations ("trade" entities).
<h2>
2. Subject Information Records
</h2>
<h3>
2.1 Overview of Information Types
</h3>
<p>
Information records are defined in definitions of "type=value" (e.g. CN=www.cacert.org) pairs.
<br>The differnet "types":
<ul>
<li>country "C"</li>
<li>organisation "O"</li>
<li>organisation unit "OU"</li>
<li>distinguised name qualifier</li>
<li>state or province "ST"</li>
<li>common name "CN"</li>
<li>locality "L"</li>
<li>postal address</li>
<li>title</li>
<li>surname "FN"</li>
<li>given name "GN"</li>
<li>initials</li>
<li>pseudonym</li>
<li>generation qualifier</li>
<li>serial number "SN".</li>
</ul>
<p>
Remarks:
<ul>
<li>common practice is that the search for a name in an certificate is prioritised: common name, given name / surname, pseudonym.</li>
<li>In the following "(<i>not-supported</i>)" will say CAcert will not evaluate the
information for the certificate, and not provide it in the issued
certificate.</li>
<li>Comparison of values are based on X.500 specification. Note this for the
comparison of names of individuals and organisations. CAcert may use own
rules on the comparison.</li>
</ul>
<h3>
2.2 Overview of information types used by CAcert
</h3>
<p>
What information types (Tagged Modulels) in the certificates issued by CAcert are implemented?
