Re: [pkix] Strings in certificates

[Russ Housley <[e-mail]>]

On Feb 5, 2016, at 6:10 PM, Wei Chuang wrote:

> >> 3) Unicode normalization
> >>
> >> A number of fields in certificates can take unicode strings.  Is there
> >> any specification as to how (or if) they should be normalized?
> >
> > I thought there were references in s7 of RFC 5280 (and some tweaks in s5 of RFC 6818).  There’s also some additional information in RFC 6125.  In a perfect world, the output of precis (https://datatracker.ietf.org/wg/precis/documents/) would be adopted the world over.  I’m not going to hold my breath though.
> 
> I don't see anything there that specifies a specific normalization
> form for storage, except for the one thing about explicitText.  I'll
> assuming anything (including mixed) is good.
> 
> Just piling on.  May be I'm misreading those two section (s7 of RFC5280 and s5 of RFC6818), while there's IDN support, there's no mention of handling Unicode in email address rfc822Name local-part or URL uniformResourceIdentifier path or query parts.  It seems like an important loophole that should be fixed.  Would folks here be willing to help in standardizing some in certificate encoding for these types?

I'm willing to help with a clarifications document.  I do not need to revisit the decisions recorded in every section of RFC 5280 all over again.

Russ