Missing subject details in end entity certificate issued from Google Certificate Authority

[abehera1]

Hi,

I have created a certificate authority infrastructure in GCP. I have 1 root , 2 issuing ca's.

I am facing an unusual error while requesting a certificate from issuing ca. If i provide CSR and request a certificate, i get the end entity certificate where i can see the "subject" details and SAN details. 

If i request a certificate directly without providing a csr,  I get the end entity certificate where i CANNOT see the "subject" details. Attached is the certificate screenshot and the requesting details. 

Why is the subject in the certificate is empty  ? Should not it contain the certificate name(testcertificate-112062022). I can see that the SAN contains testcertificate-112062022.abc.com & testcertificate-212062022)

[Jeffrey_G]

Hi abehera1,

Good day, 

Can you try this one, as per GCP public documentation CA certificate settings.
"If you want to specify a subject alternative name for your CA's certificate, you must use the Google Cloud CLI."

Regards
Jeffrey

[abehera1]

Hello Jeffrey,

Thank you for replying back. Subject alternative name comes up fine as requested. Please see the image below.

I know that subject is informational in nature but i cannot comprehend that subject is remaining blank when we are requesting certificate from Google CA

 

Regards,

Amit

[Jeffrey_G]

Hi Amit,

Can you review this one below :

I've read over RFC 5280 again and asked around a few other PKI experts, and I don't believe it's possible to entirely omit the subject from a certificate since it's a field defined in the v1 certificate rather than an X.509v3 certificate extension (which can be omitted).

Per RFC 5280 §4.1.2.6 Subject:

   ... If subject
   naming information is present only in the subjectAltName extension
   (e.g., a key bound only to an email address or URI), then the subject
   name MUST be an empty sequence and the subjectAltName extension MUST
   be critical.

We could make this optional at the API level, but if this is impossible at the X.509 layer (and the best you can do there is have an empty sequence), then I don't believe it will make any semantic difference. It would just mean writing one less initializer in the programming language / JSON being sent.


Regards

Jeff

[SAOULA_Boualem]

you can use gcloud command to get a certificate with the field subject, see bellow;
gcloud privateca certificates create new-certificate --issuer-pool=${pool} --issuer-location=${location} --generate-key --subject="CN=" --key-output-file=mykey.key --cert-output-file=cert.crt --dns-san=${san_entry} --validity=P1000D --project ${projectc_id}