title: OpenSSL CSR subject line variation with use of emailAddress
body: <p>I'm writing a simple script to generate CSRs for our staff without them having to worry about all the fiddly bits <code>openssl</code> requires and I've noticed an issue with the <code>emailAddress</code> part of the subject.</p>
  <p>When filling in the options given by the CLI, my subject is roughly:</p>
  <pre><code>Subject: C=UK, L=London, O=Org, OU=Unit, CN=my.domain/emailAddress=me@my.domain
  </code></pre>
  <p>If I use the <code>-subj</code> option on the command line and keep the parameters the same order, the result is the same:</p>
  <pre><code>$ openssl req -new -key my.key -out my.csr \
      -subj=&quot;/C=UK/L=London/O=Org/OU=Unit/CN=my.domain/emailAddress=me@my.domain&quot;
  </code></pre>
  <p>gives</p>
  <pre><code>Subject: C=UK, L=London, O=Org, OU=Unit, CN=my.domain/emailAddress=me@my.domain
  </code></pre>
  <p>But, if I put emailAddress at the front</p>
  <pre><code>$ openssl req -new -key my.key -out my.csr \
      -subj=&quot;/emailAddress=me@my.domain/C=UK/L=London/O=Org/OU=Unit/CN=my.domain&quot;
  </code></pre>
  <p>I get</p>
  <pre><code>Subject: emailAddress=me@my.domain, C=UK, L=London, O=Org, OU=Unit, CN=my.domain
  </code></pre>
  <p>What I'd like to understand is:</p>
  <ol>
  <li>What is CommonName <em>specifically</em> for?</li>
  <li>Is <code>my.domain/emailAddress=me@my.domain</code> a valid CommonName?</li>
  <li>Is <code>emailAddress</code> a valid subject name?</li>
  </ol>
  <p>The certs are for client authentication, and from a security point of view I think this doesn't matter but I am curious.</p>
  <p>(<a href="https://www.rfc-editor.org/rfc/rfc5280" rel="nofollow noreferrer">RFC5280</a> is either lacking this information or I don't understand it... probably the later)</p>