Subject: DisplayText for Verisign Certificate

From: "Amit Kapoor" <[email-masked]>
Date: Fri, 15 Oct 1999 12:04:36 -0700

While working with Bob Jueneman on some S/MIME
	certificate issues we ran into the following with
	a Verisign issued certificate:

	The portion of ASN.1 dump showing the problem:

     766 06   11:                   OBJECT IDENTIFIER
		:                     Verisign certificatePolicy (2 16 840 1 113733 1 7
1 1)
     779 30  142:                   SEQUENCE {
     782 30   40:                     SEQUENCE {
     784 06    8:                       OBJECT IDENTIFIER cps (1 3 6 1 5 5
7 2 1)
     794 16   28:                       IA5String
'https://www.verisign.com/CPS'
		:                       }
     824 30   98:                     SEQUENCE {
     826 06    8:                       OBJECT IDENTIFIER
		:                         unotice (1 3 6 1 5 5 7 2 2)
     836 30   86:                       SEQUENCE {
     838 30   21:                         SEQUENCE {
     840 16   14:                           IA5String 'VeriSign, Inc.'
                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^
     856 30    3:                           SEQUENCE {
     858 02    1:                             INTEGER 1
		:                             }
		:                           }
     861 1A   61:                         VisibleString
		:                   'VeriSign's CPS incorp. by reference liab. ltd. ('
		:                   'c)97 VeriSign'
		:                         }
		:                       }
		:                     }

	Verisign is encoding the DisplayText as IA5 whereas according to
	2459 it can be one of Visible, BMP or UTF8 string.

	Should we add IA5String to the choice list of DisplayText or treat
	this as a error and not support the Verisign certificates?

	regards

Amit

------------------------------------------------------
Certificate Authority: http://www.smeme.com
CA root : http://www.smeme.com/faq_operational.html#16
------------------------------------------------------

---

From: [email-masked] (Peter Gutmann)
Date: Sat, 16 Oct 1999 08:28:58 (NZDT)

"Amit Kapoor" <[email-masked]> writes:

>While working with Bob Jueneman on some S/MIME certificate issues we ran 
>into the following with a Verisign issued certificate:
>
>Verisign is encoding the DisplayText as IA5 whereas according to 2459 it can 
>be one of Visible, BMP or UTF8 string.
>
>Should we add IA5String to the choice list of DisplayText or treat this as a 
>error and not support the Verisign certificates?

This was quietly changed between the final draft and the RFC, as a result of 
this some implementations expect one and some expect the other.  The 
workaround I've got in my code is:

/* All draft versions of the PKIX profile had the organization as an
   IA5String, but the final RFC changed it to a VisibleString, in order
   to kludge around this for the certs which use an IA5String (which in
   practice means only Verisign, since noone else uses seems to use policy
   qualifiers), we allow both types but put the VisibleString option
   first which means it'll get used preferentially when encoding */

The code comment explains why it appears to be a Verisign bug (but isn't), 
noone else seems to use qualifiers so you won't see it anywhere else, and 
what Verisign were doing was correct at the time they did it.  I should 
really put this in the style guide.

Peter.

---

From: Alex Deacon <[email-masked]>
Date: Thu, 28 Oct 1999 18:06:18 -0700

FYI,

It looks like the proposed son-of-rfc2459 draft
(draft-ietf-pkix-new-part1-00.txt) has addressed this issue by adding
IA5String as an additional CHOICE for DisplayText.

Alex

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Saturday, October 16, 1999 1:29 AM
> To: [email-masked]
> Subject: Re: DisplayText for Verisign Certificate
> 
>