名稱編碼（Name Encoding）

Name Encoding

The following requirements apply to all Certificates listed in Section 7.1.2. Specifically, this includes Technically Constrained Non-TLS Subordinate CA Certificates, as defined in Section 7.1.2.3, but does not include certificates issued by such CA Certificates, as they are out of scope of these Baseline Requirements.

下列規定適用於第 7.1.2 節所列之所有憑證。具體而言，包括第 7.1.2.3 節所定義之「受技術約束之非 TLS 下屬憑證機構憑證（Technically Constrained Non-TLS Subordinate CA Certificates）」，但不包括由此類 CA 憑證所簽發之憑證，因該等憑證不屬於本《基本要求》之適用範圍。

For every valid Certification Path (as defined by RFC 5280, Section 6):

• For each Certificate in the Certification Path, the encoded content of the Issuer Distinguished Name field of a Certificate SHALL be byte-for-byte identical with the encoded form of the Subject Distinguished Name field of the Issuing CA certificate.
• For each CA Certificate in the Certification Path, the encoded content of the Subject Distinguished Name field of a Certificate SHALL be byte-for-byte identical among all Certificates whose Subject Distinguished Names can be compared as equal according to RFC 5280, Section 7.1, and including expired and revoked Certificates.

針對每一條有效的憑證路徑（Certification Path，定義見 RFC 5280 第 6 節）：

• 對於憑證路徑中之每張憑證，其簽發者唯一識別名稱（Issuer Distinguished Name）欄位的編碼內容，應（SHALL）與簽發憑證機構（Issuing CA）憑證的主體唯一識別名稱（Subject Distinguished Name）欄位之編碼形式逐位元組完全相同。
• 對於憑證路徑中之每張 CA 憑證，其主體唯一識別名稱（Subject Distinguished Name）欄位的編碼內容，應（SHALL）在所有依 RFC 5280 第 7.1 節 比對為相等之主體唯一識別名稱（Subject Distinguished Name）的憑證中逐位元組完全相同（包括已過期及已廢止之憑證）。

When encoding a Name, the CA SHALL ensure that:

• Each Name MUST contain an RDNSequence.
• Each RelativeDistinguishedName MUST contain exactly one AttributeTypeAndValue.
• Each RelativeDistinguishedName, if present, is encoded within the RDNSequence in the order that it appears in Section 7.1.4.2.
  • For example, a RelativeDistinguishedName that contains a countryName AttributeTypeAndValue pair MUST be encoded within the RDNSequence before a RelativeDistinguishedName that contains a stateOrProvinceName AttributeTypeAndValue.
• Each Name MUST NOT contain more than one instance of a given AttributeTypeAndValue across all RelativeDistinguishedNames unless explicitly allowed in these Requirements.

編碼 Name 時，CA 應（SHALL）確保：

• 每個 Name 應（MUST）包含一個 RDNSequence。
• 每個 RelativeDistinguishedName 應（MUST）包含僅有一個 AttributeTypeAndValue。
• 每個 RelativeDistinguishedName（若存在）在 RDNSequence 中的排列順序，與其於第 7.1.4.2 節之出現順序一致。
  • 例如，包含成對之 countryName AttributeTypeAndValue 的 RelativeDistinguishedName，應（MUST）在 RDNSequence 中排列於包含 stateOrProvinceName AttributeTypeAndValue 的 RelativeDistinguishedName 之前。
• 每個 Name 中，任一特定之 AttributeTypeAndValue 不得（MUST NOT）在所有 RelativeDistinguishedName 中出現超過一次，除非本文件明確允許。

Note: Section 7.1.2.2.2 provides an exception to the above Name encoding requirements when issuing a Cross-Certified Subordinate CA Certificate, as described within that section.

注意：第 7.1.2.2.2 節針對簽發交互認證之下屬憑證機構憑證（Cross-Certified Subordinate CA Certificate），訂有上述 Name 編碼要求之例外規定，詳如該節所述。