Re: [pkix] Strings in certificates

[Wei Chuang <[e-mail]>]

On Fri, Feb 5, 2016 at 3:40 PM, Russ Housley <[e-mail]> wrote:

>
> On Feb 5, 2016, at 6:10 PM, Wei Chuang wrote:
>
> >> 3) Unicode normalization
>> >>
>> >> A number of fields in certificates can take unicode strings.  Is there
>> >> any specification as to how (or if) they should be normalized?
>> >
>> > I thought there were references in s7 of RFC 5280 (and some tweaks in
>> s5 of RFC 6818).  There’s also some additional information in RFC 6125.  In
>> a perfect world, the output of precis (https://datatracker.ietf.org/
>> wg/precis/documents/) would be adopted the world over.  I’m not going to
>> hold my breath though.
>>
>> I don't see anything there that specifies a specific normalization
>> form for storage, except for the one thing about explicitText.  I'll
>> assuming anything (including mixed) is good.
>>
>
> Just piling on.  May be I'm misreading those two section (s7 of RFC5280
> and s5 of RFC6818), while there's IDN support, there's no mention of
> handling Unicode in email address rfc822Name local-part or URL uniformResourceIdentifier
> path or query parts.  It seems like an important loophole that should be
> fixed.  Would folks here be willing to help in standardizing some in
> certificate encoding for these types?
>
>
> I'm willing to help with a clarifications document.
>

That sounds like a good approach.

-Wei


> I do not need to revisit the decisions recorded in every section of RFC
> 5280 all over again.
>
> Russ
>
>
>
>