Subject Directory Attribute JSON format

Use the Subject Directory Attribute JSON format to provide encoded Subject Directory Attribute values in a certificate profile or enrollment request.

This format is supported when allow_encoded_ext_value is set to true.

When to use the format?

Use this format when you need to define one or more Subject Directory Attributes with custom ASN.1 content.

You can provide the value:

As a default value in a certificate profile
In an enrollment request

Each Subject Directory Attribute must begin with an object identifier (OID) followed by the ASN.1 values associated with that OID.

Required JSON structure

The top-level element must be a SEQUENCE. Its value array contains one or more nested SEQUENCE elements, with each nested sequence representing a Subject Directory Attribute.

JSON structure example:

{
  "type": "SEQUENCE",
  "value": [
    {
      "type": "SEQUENCE",
      "value": [
        {
          "type": "OBJECT_IDENTIFIER",
          "value": "object identifier value #1"
        }, {
          // custom content
        }
      ]
    }, {
      "type": "SEQUENCE",
      "value": [
        {
          "type": "OBJECT_IDENTIFIER",
          "value": "object identifier value #2"
        }, {
          // custom content
        }
      ]
    },
    ...
    {
      "type": "SEQUENCE",
      "value": [
        {
          "type": "OBJECT_IDENTIFIER",
          "value": "object identifier value #N"
        }, {
          // custom content
        }
      ]
    }
  ]
}

JSON-to-ASN.1 type mappings

Use the following JSON types to define the corresponding ASN.1 objects:

Table 1. JSON-to-ASN.1 type mappings

JSON type	ASN.1 type	Value requirements
SEQUENCE	DERSequence	Provide an array of JSON elements
SET	DERSet	Provide an array of JSON elements
OBJECT_IDENTIFIER	DERObjectIdentifier	Provide a dot-separated numeric OID, such as `1.3.6.1.4.1.51552.9.1`
STRING	DERUTF8String	Provide a UTF-8 string
INTEGER	DERInteger	Provide an integer value
BOOLEAN	DERBoolean	Provide `true` or `false`
IA5_STRING	DERIA5String	Provide an IA5 string
OCTET_STRING	DEROctetString	Provide a `hexadecimal-encoded binary value`

Structure requirements

Follow these requirements when constructing the JSON value:

Set the top-level type to SEQUENCE
Define the top-level value as an array containing one or more nested sequences
Use one nested SEQUENCE for each Subject Directory Attribute
Start each nested sequence with an OBJECT_IDENTIFIER
Provide the OID as dot-separated numbers, such as 1.3.6.1.4.1.51552.9.1
Add the attribute content after the OID
Use only the JSON types listed in the JSON-to-ASN.1 type mappings table.
Nest SEQUENCE and SET elements as needed to represent the required ASN.1 data structure
Provide OCTET_STRING values as hexadecimal-encoded binary data

Complete JSON structure example:

The following example defines two Subject Directory Attributes:

OID 1.3.6.1.4.1.51552.9.1, with an integer value inside a set
OID 1.3.6.1.4.1.51552.92.5, with a Boolean value and a UTF-8 string

{
  "type": "SEQUENCE",
  "value": [
    {
      "type": "SEQUENCE",
      "value": [
        {
          "type": "OBJECT_IDENTIFIER",
          "value": "1.3.6.1.4.1.51552.9.1"
        },
        {
          "type": "SET",
          "value": [
            {
              "type": "INTEGER",
              "value": "202"
            }
          ]
        }
      ]
    }, {
      "type": "SEQUENCE",
      "value": [
        {
          "type": "OBJECT_IDENTIFIER",
          "value": "1.3.6.1.4.1.51552.92.5"
        },
        {
          "type": "BOOLEAN",
          "value": true
        }, 
        {
          "type": "STRING",
          "value": "exaple string"
        }
      ]
    }
  ]
}

In this section: