Skip to main content

Subject directory attributes (SDA)

DigiCert​​®​​ IoT Trust Manager supports the subject directory attributes (SDA) certificate extension.

When requesting a certificate using DigiCert​​®​​ IoT Trust Manager, you can use the subject directory attributes (SDA) certificate extension to store information supplemental to the certificate’s standard fields and extensions. To use the SDA extension, create a JSON-formatted object describing the attributes and information you want to store. You must include this JSON object as part of your certificate request.

Notice

To store data in the SDA extension, you must request a certificate using an enrollment profile that supports subject directory attributes. This enrollment profile must use a certificate profile created with a template that includes the subject directory field. To get a certificate template that supports the SDA extension, contact your DigiCert ONE account representative.

SDA JSON object

The SDA JSON object contains a sequence of elements, where each element describes a non-standard attribute you want to add to the certificate. There is no limit to the number of elements this sequence can contain.

  • Each element in the top-level sequence contains another sequence of objects.

  • The first element in each sub-sequence describes the object identifier (OID) of a supplemental attribute.

  • The elements following the OID describe the SDA data structure and the information you want it to contain.

Each element in the SDA JSON object requires these two fields:

  • type: Data type of the content in the corresponding value field.

    Allowed values: See the SDA data types table below. Each type corresponds with an ASN.1 type under the DER serialization format. Case-sensitive.

  • value: Value of the element. Must match the defined type for the element.

Examples

The structure of the SDA JSON object is the same for both REST API and UI console requests.

  • REST API: Submit the JSON data in the certificate_profile_attributes section of the Request certificate payload.

    • The id is extensions.subject_directory.

    • The value is the SDA data, formatted as a JSON string.

  • UI console: Submit the JSON object in the Subject directory field of the certificate request form.

Properties

Name

Type

Req/Opt

Description

type

string

required

Data type of the content in the corresponding value field.

Note: The type value for the top-level object should be SEQUENCE (case-sensitive).

value

array

required

Ordered list of objects. Each object contains a sequence with details about a specific attribute. Include as many elements as needed.

.. type

string

required

Data type of the content in the value field.

Note: The type value for each element in the top-level sequence should also be SEQUENCE (case sensitive).

.. value

array

required

Ordered list of objects that describe the SDA data structure and information to store for the attribute.

  • The first object in this list should contain the object identifier (OID) for the attribute. The type field should be OBJECT_IDENTIFIER (case-sensitive), and the value field should contain the OID (a string of positive integers, separated by dots).

  • Objects that follow the first element should describe the SDA data structure and the information to store for the SDA. These subsequent elements can be any type listed in the SDA data types table below.

.. .. type

string

required

Data type of the content in the corresponding value field.

Allowed values: See the SDA data types table below. Each allowed value corresponds with an ASN.1 type under the DER serialization format. Case-sensitive.

.. .. value

Set by type value

required

Value to store in the SDA.

SDA data types

Type

ASN.1 Type

Description

SEQUENCE

DERSequence

Ordered collection of one or more elements.

SET

DERSet

Unordered collection of one or more elements.

OBJECT_IDENTIFIER

DERObjectIdentifier

String of positive integers, separated by dots, that identifies an object.

STRING

DERUTF8String

UTF-8 encoded string.

INTEGER

DERInteger

Positive or negative integer.

BOOLEAN

DERBoolean

Boolean value (true or false).