![](https://csdnimg.cn/release/download_crawler_static/10988855/bg11.jpg)
ISO/IEC 9594-6:2017 (E)
Rec. ITU-T X.520 (10/2016) 9
b) It is an A-label as defined in IETF RFC 5890, i.e., it starts with the "xn--" and is a U-label converted to
valid ASCII characters as in item a) using the Punycode algorithm defined by IETF RFC 3492. The
converted string shall be maximum 59 octets. To be valid, it shall be possible for an A-label to be converted
to a valid U-label.
NOTE 1 – An A-label is normally not human readable.
c) It is a U-label as defined in IETF RFC 5890, i.e., it contains characters outside the Basic Latin collection.
A valid U-label shall not include any characters that are not included in the restricted Unicode repertoire
as defined by IETF RFC 5892 and it shall be convertible to a valid A-label as defined in item b). A valid
U-label may be more than 63 octets.
NOTE 2 – In a constraint environment, it is recommended to use a domain name whenever possible, according to item a).
NOTE 3 – When used as a naming attribute, a unique distinguished name may be constructed using only this attribute type.
An attribute of type dnsName to be used as a distinguished name in a public-key certificate or in an attribute certificate
shall be a fully-qualified domain name (FQDN), i.e., it shall identify a particular entity. An FQDN may have an asterisk
('*') as an additional leftmost label, which is a substitute (wildcard) for all labels at the next levels of subdomains of the
domain identified by the FQDN without the asterisk. An attribute of type dnsName holding an FQDN with a wildcard
label may in some cases be used in the subject component of an end-entity public-key certificate.
6.3 Geographical attribute types
These attribute types are concerned with geographical positions or regions with which objects are associated.
6.3.1 Country Name
A value of the countryName attribute type specifies a country. When used as a component of a directory name, it
identifies the country in which the named object is physically located or with which it is associated in some other important
way.
An attribute value for country name is a string chosen from ISO 3166-1 alpha-2.
countryName ATTRIBUTE ::= {
SUBTYPE OF name
WITH SYNTAX CountryName
SINGLE VALUE TRUE
LDAP-SYNTAX countryString.&id
LDAP-NAME {"c"}
ID id-at-countryName }
CountryName ::= PrintableString(SIZE (2)) (CONSTRAINED BY { -- ISO 3166 alpha-2 codes
only -- })
6.3.2 Three-character country code
A value of countryCode3a attribute type specifies a country. When used as a component of a directory name, it identifies
the country in which the named object is physically located or with which it is associated in some other important way.
An attribute value for countryCode3a is a string chosen from ISO 3166-1 alpha-3.
countryCode3c ATTRIBUTE ::= {
SUBTYPE OF name
WITH SYNTAX CountryCode3c
SINGLE VALUE TRUE
LDAP-SYNTAX countryString3c.&id
LDAP-NAME {"c3"}
ID id-at-countryCode3c }
CountryCode3c ::= PrintableString(SIZE (3)) (CONSTRAINED BY { -- ISO 3166 alpha-3 codes
only -- })
6.3.3 Numeric character country code
A value of countryCode3n attribute type specifies a country. When used as a component of a directory name, it identifies
the country in which the named object is physically located or with which it is associated in some other important way.
An attribute value for countryCode3n is a string chosen from ISO 3166-1 numeric-3.
countryCode3n ATTRIBUTE ::= {
SUBTYPE OF name