6 ms·
We (Let's Encrypt) are getting rid of subject common names and moving to just using subject alternative names. This change has been made in short-lived (6 day)
by jaas 1y ago
We (Let's Encrypt) are getting rid of subject common names and moving to just using subject alternative names.
This change has been made in short-lived (6 day) certificate profiles. It has not been made for the "classic" profile (90 day).
- tialaramex 1y agoHave you found much trouble with clients that can't cope without CN? Is this one of those situations where anything that can't cope is also hopeless for other reasons (e.g. can't speak TLS 1.2, doesn't understand IPv6, that sort of thing) and so you can tell people you're not their biggest problem ?
- jcgl 1y agoIt’d surely be something like that. CN has been deprecated and SAN support has been required for 25 years at this point[0]. [0] https://datatracker.ietf.org/doc/html/rfc2818#section-3.1 https://datatracker.ietf.org/doc/html/rfc2818#section-3.1
- tialaramex 1y agoI'm aware that PKIX deprecated use of CN for this purpose at the turn of the century, but when browsers began ignoring CN about a decade ago (which is the first half of the adoption curve) I know Google had to ship an enterprise override for people whose corporate systems could not cope. If it's true that all or almost all systems now work properly that's great news.