A certificate subject identifies the main entity—such as a person, organization, or server—to which an X.509 certificate was issued. Its fields contain the public key and metadata describing its owner. For a website, the subject commonly includes organization details and a common name, while the Subject Alternative Name extension lists additional identifiers such as DNS names, IP addresses, URIs, or email addresses. section 8.1.4 section 8.4
Reading the subject for github.com
An inspected certificate can show `Subject: C=US, ST=California, L=San Francisco, O="GitHub, Inc.", CN=github.com`. The same certificate lists `DNS:github.com` and `DNS:www.github.com` in its SAN extension. The subject describes the principal owner and associated public key; SAN adds identifiers beyond the main subject fields. section 8.1.3 section 8.1.4
Inspect a certificate subject with OpenSSL and keep these distinctions in mind:
- Use `openssl x509 -in github-cert.pem -noout -text` to display the certificate’s subject, issuer, validity, public key, and extensions. section 8.1.3
- Recognize the common subject attributes: C for country, ST for state, L for locality, O for organization, and CN for common name. section 8.1.4
- Do not treat an IP address as a durable owner identity: addresses can be reassigned and reused. section 8.3
Listing 8.4 Subject fields for the github.com certificate as of March 5, 2022
Subject: C=US,ST=California,L=San Francisco,O="GitHub, Inc.",CN=github.com
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:a3:a4:03:46:03:df:46:51:56:cb:c9:39:ab:22:
cd:e7:6c:59:96:7a:93:a0:fb:b9:40:1c:90:32:88:
36:c6:09:76:9c:50:f5:55:f7:76:5e:68:20:9c:ee:
22:ed:83:0c:15:30:10:41:44:5e:32:ac:90:a1:d5:
aa:f2:e5:43:b3
ASN1 OID: prime256v1
NIST CURVE: P-256
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:github.com, DNS:www.github.com
Browse the extracted GitHub certificate fields, including the subject, public key, and SAN extension. section 8.1.4
