ssl-certificatecertificatex509certificateclient-certificatesrfc

Does RFC5280 require the RDNSequence in the CRL Issuer field to be output in reverse order in the string?

I saw in RFC 4514 that the RDNSequence should be output in reverse order in the string (for example: RDNSequence (binary order): [C=US, O=Example, CN=CA]

String representation (RFC 4514): CN=CA,O=Example,C=US). I did not find any related specification in RFC 5280. Could you please confirm whether RFC 5280 also requires the RDNSequence to be output in reverse order in the string?

Solution

  • All types of ASN.1 DirectoryName type are encoded from root down to leaf X.520 node. String representation is formatted in reverse order: from leaf down to root node. Issuer field in certificates and CRLs are of type of DirectoryName, so same rules apply.