TLS: assigning certificates to username

Stefan Paetow Stefan.Paetow at
Thu May 5 18:31:42 CEST 2016

>> So in fact I revise my previous statement, if your cert contains an NAI in the CN part of the subject, your system administrator is an idiot.
> and if you check your Network RADIUS issued S/MIME certificate.  Oh, oh what's that? A subjectAltName with your username as an NAI? Look at that :)

Catfight! ;-)

user at in the FreeRADIUS directory yields this:

root at debian8:/etc/freeradius/certs# openssl x509 -in user\ -text
        Version: 3 (0x2)
        Serial Number: 2 (0x2)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=FR, ST=Radius, L=Somewhere, O=Example Inc./emailAddress=admin at, CN=Example Certificate Authority
            Not Before: Apr 28 20:57:32 2016 GMT
            Not After : Jun 27 20:57:32 2016 GMT
        Subject: C=FR, ST=Radius, O=Example Inc., CN=user at at
        Subject Public Key Info: [trimmed]
        X509v3 extensions: [trimmed]
    Signature Algorithm: sha256WithRSAEncryption [trimmed]

There the Subject CN contains... a NAI? ;-)

Is that standards-compliant?

Stefan Paetow
Moonshot Industry & Research Liaison Coordinator

t: +44 (0)1235 822 125
gpg: 0x3FCE5142
xmpp: stefanp at
skype: stefan.paetow.janet

Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 496 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <>

More information about the Freeradius-Users mailing list