Certificate State/Province Name Best Practice

TL;DR

Always use the full, official name of the state or province in your certificate requests (CSRs). Avoid abbreviations. Consistency is key for trust and avoiding browser warnings.

Certificate State/Province Name Best Practice Guide

1. Understand Why It Matters: The stateOrProvinceName field in a digital certificate helps verify the identity of the organisation requesting it. Browsers use this information, along with other details, to establish trust. Incorrect or inconsistent data can lead to security warnings for your website visitors.
2. Use Full Names: Always enter the full and official name of the state, province, county, or region. Do not use abbreviations.
   • Correct: California
   • Incorrect: CA
   • Correct: Ontario
   • Incorrect: ON
3. Check Official Sources: If you’re unsure of the correct name, consult official government websites. A quick search for “official state names” or your province’s equivalent will provide accurate information.
   • For US states: USA.gov State Abbreviations
4. Consistency is Crucial: Ensure the stateOrProvinceName matches the legal registration documents of your organisation.
   • If your business is registered as “California Corporation”, use “California” in the certificate request.
5. Generating a CSR (Certificate Signing Request): The process for creating a CSR varies depending on your web server software. Here are examples:
   • OpenSSL: When prompted during CSR generation, provide the full state/province name.

     openssl req -newkey rsa:2048 -nodes -keyout example.key -out example.csr

   • Apache: Edit your Apache configuration file and ensure the correct stateOrProvinceName is specified in the CSR generation section.

     # Example (may vary depending on your setup) 
     Common Name (e.g., server FQDN or Your domain name): example.com
     Organizational Unit Name: IT Department
     Organization Name: Example Ltd
     Locality Name: London
     State/Province Name: Greater London
     Country Name: UK

   • IIS (Internet Information Services): Use the IIS Certificate Wizard and carefully enter the full state/province name during the request process.
6. Verify Your Certificate Details: After receiving your certificate, verify that the stateOrProvinceName is correct.
   • You can use online SSL checkers to view your certificate details:
     SSL Shopper SSL Checker
7. Renewal Considerations: When renewing your certificate, double-check the stateOrProvinceName to ensure it remains consistent with your current legal registration information.