Michael Str�der wrote:
>
> > o Steve is currently working on
> > Various X509 issues: character sets, certificate request extensions.
>
> I am very much interested in learning more about these character set
> issues. Where can I start reading about the valid character
> sets/encodings in X.509 and OpenSSL?
>
One big issue at present: YOU CAN'T USE NETSCAPE!! It crashes when
BMPStrings or UTF8Strings are present in things like S/MIME email.
IE5 supports BMPStrings but not UTF8Strings. Its Xenroll enrollment
control use BMPStrings but can be persuaded to use T61Strings. My
limited knowledge of other languages suggests Cyrillic isn't in
ISO-8859-1 though.
> Examples:
>
> M$ IE is using different character encoding during generating a
> certificate request. 'openssl ca' says "ASN.1" to this encoding (in
> opposite to "T61String" with SPKAC requests containing ISO-8859-1
> characters). Well, I know how to handle this in a ISO-8859-1
> environment. But I don't know a generic way...
>
I assume the SPKAC doesn't look right? In future OpenSSL might allow the
SPKAC to use UTF8 encoding and handle things that way. All academic
though because this wont work with Netscape.
> A russian pyCA user requested support for his KOI-8 (kyrillic) based web
> environment and I am not quite sure how this can be achieved with
> OpenSSL...
>
Tricky at present. The main problem is how to display international
characters on all platforms. What is likely to happen is that the 'ca'
utility will not be able to properly display the string but it should
still sign the request properly.
If there's a way to display BMPStrings then this shouldn't be a problem:
you might even be able to parse the output of 'ca' and handle it
properly.
I think the best OpenSSL can do in the short term is to give some
options on how these things are displayed: for example converting to
enescaped UTF8 which should then be displayed properly on a "UTF8
console".
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
