Subject: RFC3280: doubt on the use of UTF8String in encoding RDNs

From: Santoni Adriano <[email-masked]>
Date: Mon, 5 Apr 2004 17:28:58 +0200

Dear all,

I am probably asking an old question, so ... please be patient.

Rfc3280 states (§4.1.2.4): "...all certificates issued after December 31,
2003 MUST use the UTF8String encoding of DirectoryString...".

Does that mean that it is mandatory to always encode all RDNs (having a type
of DirectoryString) of the issuer and subject (and still other) certificate
fields as UTF8Strings _even if they could be correctly encoded as a
PrintableStrings_ ? 

TIA to all volunteers,
  Adriano

*******************Internet Email Confidentiality Footer******************* 
Qualsiasi utilizzo non autorizzato del presente messaggio nonche' dei suoi
allegati e' vietato e potrebbe costituire reato. Se lei ha ricevuto
erroneamente il presente messaggio, Le saremmo grati se, via e-mail, ce ne
comunicasse la ricezione e provvedesse alla distruzione del messaggio stesso
e dei suoi eventuali allegati. Le dichiarazioni contenute nel presente
messaggio nonche' nei suoi eventuali allegati devono essere attribuite
esclusivamente al mittente e non possono essere considerate come trasmesse o
autorizzate da SIA S.p.A.; le medesime dichiarazioni non impegnano SIA
S.p.A. nei confronti del destinatario o di terzi. 
SIA S.p.A. non si assume alcuna responsabilita' per eventuali
intercettazioni, modifiche o danneggiamenti del presente messaggio e-mail. 

Any unauthorized use of this e-mail or any of its attachments is prohibited
and could constitute an offence. If you are not the intended addressee
please advise immediately the sender by using the reply facility in your
e-mail software and destroy the message and its attachments. The statements
and opinions expressed in this e-mail message are those of the author of the
message and do not necessarily represent those of SIA. Besides, The contents
of this message shall be understood as neither given nor endorsed by SIA
S.p.A.. 
SIA S.p.A. does not accept liability for corruption, interception or
amendment, if any, or the consequences thereof.

---

From: [email-masked] (Peter Gutmann)
Date: Thu, 08 Apr 2004 01:54:40 +1200

Santoni Adriano <[email-masked]> writes:

>Rfc3280 states (<A7>4.1.2.4): "...all certificates issued after December 31,

Hmm, see the previous thread on this a few months ago... in theory you're
supposed to do this, but that violates the primary rule of DN encoding, which
is "Never change the DN once it's been encoded by the originator".  If you
break that rule, you get to discover all the apps that reject re-encoded DNs.
If you're lucky, this will happen before your product ships and not after.

Peter.