Subject: Re: PrintableString not usable tigether with OCSP?

From: [email-masked] (Peter Gutmann)
Date: Fri, 15 Nov 2002 15:20:23 +1300 (NZDT)

Steve Hanna <[email-masked]> writes:

>If you'd like to have some certs that contain subject or issuer names with
>UTF8String, let me know. I'd be glad to send you some.

I have certs with these [0], what I'd be interested in seeing is a PKCS #7
chain with issuer.subjectDN in Unicode and subject.issuerDN in UTF8, to see
how much software actually handles this.  In other words, a cert chain where
memcmp() won't work for checking chaining.

Peter.

[0] OTOH more can never heart, so if you have a few samples please beam them
    over.

---

From: Steve Hanna <[email-masked]>
Date: Fri, 15 Nov 2002 17:19:15 -0500

I'll send you some UTF8String certs. It's always good
to check interoperability. I don't have a chain with
BMPString or UnicodeString. They are not widely used
and UTF8String is preferred by RFC 3280, so we didn't
implement them. I could write some code to generate
such a chain, if you like...

There are other cases where memcmp would not be sufficient.
For one thing, DN matching is supposed to be case-insensitive
and ignore excess white space (as described in RFC 2459,
RFC 3280, and X.520). memcmp won't handle that. Also, there
are many ways to encode a particular name in Unicode.
For instance, the é in José can be encoded as a composite
character (U+00E9) or as a base character and a combining
character (U+0065 U+0301). X.500 names with either of these
two encodings should match.

-Steve