Issuing certificates when the subject field is empty

[3keyroman]

In the RFC 5280 section 4.2.1.6 Subject Alternative Name is written

Further, if the only subject identity included in the certificate is
an alternative name form (e.g., an electronic mail address), then the
subject distinguished name MUST be empty (an empty sequence), and the
subjectAltName extension MUST be present. If the subject field
contains an empty sequence, then the issuing CA MUST include a
subjectAltName extension that is marked as critical. When including
the subjectAltName extension in a certificate that has a non-empty
subject distinguished name, conforming CAs SHOULD mark the
subjectAltName extension as non-critical.

EJBCA can be configured to issue certificate with empty subject field and no subjectAltName extension. At least in the version 8.3.1 we were using to test this behaviour.

If I am interpreting the RFC correctly, the CA should not issue certificate with empty subject field, when there is no subjectAltName, and from that perspective, it can be considered as a bug.

When you try to use such certificate in Java for example, you will get an exception:

java.security.cert.CertificateParsingException: X.509 Certificate is incomplete: subject field is empty, and SubjectAlternativeName extension is absent

You can set the end entity profile to include the subjectAltName with empty subject field, however, the subjectAltName extension will not be marked as critical.

What do you think, is my interpretation correct and the check for that should be implemented in EJBCA? Or it is on purpose and I missed something?

[primetomas]

As this is easy to configure it is on the CA, not the CA software, to ensure that profiles adheres to the relevant (for that CA) standards. In general the CA software can not enforce RFC5280 strictly because lots of standards out there have details that are not RFC 5280 compliant. This includes global critical standards such as ICAO 9303, or CA/B Forum baseline requirements.

[3keyroman]

Thanks, @primetomas , for the clarification, now I understand it better!