In this chapter, you will find information about searching the Windows certificate store and the rules used to verify and prioritize search results.
When a search term is entered, each certificate is checked according to the rules in the order listed below. The first rule that yields a match determines the result. Search results are case-insensitive, and spaces before and after the search term are removed or ignored.
An explanation of the abbreviations used can be found after the table.
The examples listed below are based on certificates that have the following properties:
-
Subject: CN = web.example.com, O = iba AG, C = DE
-
Issuer: CN = iba Root CA, O = iba AG, C = DE
-
SAN: DNS = web.example.com, IP = 192.168.1.10
Matching rules
From highest priority (top) to lowest priority (bottom)
|
Prio | Rule |
Description |
Example search term |
|---|---|---|
|
1 | Exact Subject |
The Subject/CN string is exactly equal to the search term. |
CN=web.example.com, O=iba AG, C=DE |
|
2 | Subject contains |
The Subject/CN contains the search term. |
web.example.com |
|
3 | Exact Distiguished Name |
The Subject matches the search term parsed as a full DN. Catches DNs identical in content but formatted differently (e.g. spacing) than the raw Subject string. |
CN=web.example.com,O=iba AG,C=DE (no spaces after commas) |
|
4 | Semantic Distinguished Name |
The Subject matches the search term as a semantically equivalent DN, tolerating differences such as RDN order. |
C=DE, O=iba AG, CN=web.example.com (components reversed) |
|
5 | Issuer |
The Issuer contains the search term. |
iba Root CA |
|
6 | Subject Alternative Names (SAN) |
A SAN entry (DNS, IP, Email, or UPN) contains the search term. |
192.168.1.10 |
|
7 | No match |
None of the above rules apply; the certificate is not matched. |
unknown.host.local |
Key to Abbreviations
CN – Common Name: The "main name" in a certificate's subject field, usually the hostname or domain (e.g., web.example.com). In the case of web server certificates, it identifies the server.
DN – Distinguished Name: The complete, unique name of a certificate subject, composed of several components (RDNs). Example: CN=web.example.com, O=iba AG, C=DE. So the CN is only a part of the DN.
RDN – Relative Distinguished Name: A single component within a DN, such as CN=web.example.com or O=iba AG. Several RDNs together make up the DN.
CA – Certificate Authority: The entity that issues and signs certificates. With a self-signed certificate, the issuer is the certificate itself; with a PFX file provided by the customer, there is usually a real CA. (In your setup, CA is also the name of the subfolder in ProgramData where the certificate is stored.)
SAN – Subject Alternative Name: Additional names or addresses for which the certificate is also valid, in addition to the CN. Types: DNS (host names), IP (IP addresses), email, UPN (User Principal Name). Modern browsers primarily check the SAN entries, not the CN anymore.
O – Owner/Issuer: Owner or issuer of the certificate
C – Country of the issue; for example, C = DE for Germany