At the moment I am developing an Web application that will serve as a MS CA interface for certification enrollment. The error comes out after the app have generated the csr and send it to CA. Certificate should have the following structure:
Serialnumber = UserId, CN = FirstName SecondName, O = Organization, P = PhoneNumber
Here is a real example:
Serialnumber = 200554041000, CN = John Farel, O = SRL Insign, P = 60182209, C = MD
Error shown is:
CertEnroll::CX500DistinguishedName::Encode: The string contains an invalid X500 name attribute key, oid, value or delimiter. 0x80092023 (-2146885597)
If I remove P or change it on Phone everything goes well and certificate is being generated.
And second!! :) After certificate have been generated subjects DN contains everything bun not Serialnumber and Phone.
I am using MS CA on MS Windows Server 2008, CA Cryptography Service Provider: Microsoft Software Storage Provider, Hash Algorithm: SHA1.
For more information leave a comment. Thank you anticipated!
Few things to know:
1) "PhoneNumber" attribute is named "Phone", not "P" or whatever else.
EDIT:
2) I checked SDK and, unfortunately, it appears that it is not possible to include Phone RDN attribute in the subject. From header file only these attributes can be added:
//+--------------------------------------------------------------------------
// Name properties:
#define wszPROPDISTINGUISHEDNAME TEXT("DistinguishedName")
#define wszPROPRAWNAME TEXT("RawName")
#define wszPROPCOUNTRY TEXT("Country")
#define wszPROPORGANIZATION TEXT("Organization")
#define wszPROPORGUNIT TEXT("OrgUnit")
#define wszPROPCOMMONNAME TEXT("CommonName")
#define wszPROPLOCALITY TEXT("Locality")
#define wszPROPSTATE TEXT("State")
#define wszPROPTITLE TEXT("Title")
#define wszPROPGIVENNAME TEXT("GivenName")
#define wszPROPINITIALS TEXT("Initials")
#define wszPROPSURNAME TEXT("SurName")
#define wszPROPDOMAINCOMPONENT TEXT("DomainComponent")
#define wszPROPEMAIL TEXT("EMail")
#define wszPROPSTREETADDRESS TEXT("StreetAddress")
#define wszPROPUNSTRUCTUREDNAME TEXT("UnstructuredName")
#define wszPROPUNSTRUCTUREDADDRESS TEXT("UnstructuredAddress")
#define wszPROPDEVICESERIALNUMBER TEXT("DeviceSerialNumber")
3) avoid "Microsoft Software Key Storage Provider" provider use in your .NET application, because it is CNG provider and X509Certificate2
do not support CNG (shame on .NET). Though, it is recommended to use KSP for CA keys (when there is no HSM).
User contributions licensed under CC BY-SA 3.0