Kikuyo Nagamatsu wrote: > > Hi, all > > I need some advices. > I tried to creating request (and certificate) in UTF8 format. > Openssl can make UTF8 certificate from UTF8 request. > > I input DN UTF8 chacters like this. > iconv -f eucJP -t UTF-8 kanji_dat.euc > kanji_dat.utf8 > cat kanji_dat.utf8 | ../openssl req -new -key kanji.pem.key -out kanji.req >-config openssl.conf > > What I did were.. > > ----------------------------------------------- > (1) specify "string_mask = utf8only" in [req] section and > create certificate in UTF8 string.Then the certificate that I got was > ASN.1 type was UTF8 , > but code was not UTF8String. > > >subject=/C=JP/O=XXXXX/L=\xC3\xA3\xC2\x83\xC2\xA1\xC3\xA3\xC2\x83\xC2\xA9\xC3\xA3\xC2\x83\xC2\xB3\xC3\xA3\xC2\x82\xC2\ > xB8/CN=\xC3\xA6\xC2\xBC\xC2\xA2\xC3\xA5\xC2\xAD\xC2\[EMAIL PROTECTED] > 171:d=5 hl=2 l= 3 prim: OBJECT :organizationName > 176:d=5 hl=2 l= 16 prim: UTF8STRING > 194:d=3 hl=2 l= 33 cons: SET > 196:d=4 hl=2 l= 31 cons: SEQUENCE > 198:d=5 hl=2 l= 3 prim: OBJECT :localityName > 203:d=5 hl=2 l= 24 prim: UTF8STRING > 229:d=3 hl=2 l= 23 cons: SET > > (2) So I modified "req.c" file as following. > > 1124c1124,1125 > < if (!X509_NAME_add_entry_by_txt(subj,type, MBSTRING_ASC, > --- > > //if (!X509_NAME_add_entry_by_txt(subj,type, MBSTRING_ASC, > > if (!X509_NAME_add_entry_by_txt(subj,type, MBSTRING_UTF8, > 1189c1190,1191 > < if (!X509_NAME_add_entry_by_NID(n,nid, MBSTRING_ASC, > --- > > //if (!X509_NAME_add_entry_by_NID(n,nid, MBSTRING_ASC, > > if (!X509_NAME_add_entry_by_NID(n,nid, MBSTRING_UTF8, > > And then what I can get is both of ASN.1 type and code is UTF. > >subject=/C=JP/O=XXXXX/L=\xE3\x83\xA1\xE3\x83\xA9\xE3\x83\xB3\xE3\x82\xB8/CN=\xE6\xBC\xA2\xE5\xAD\x97CN/Email=yyy@ > xxxxx.co.jp > 168:d=4 hl=2 l= 23 cons: SEQUENCE > 170:d=5 hl=2 l= 3 prim: OBJECT :organizationName > 175:d=5 hl=2 l= 16 prim: UTF8STRING > 193:d=3 hl=2 l= 21 cons: SET > 195:d=4 hl=2 l= 19 cons: SEQUENCE > 197:d=5 hl=2 l= 3 prim: OBJECT :localityName > 202:d=5 hl=2 l= 12 prim: UTF8STRING > > Although the modification is so forced, but if I specify "string_mask = utf8only" > in [req] section, I can get UTF8 certificate, and if I specify "string_mask = nmbstr" > I can get ascii certificate. > Because X509_NAME_ENTRY_ser_data() (crypt/x509/x509name.c) check the conf and > then write ASN.1 format. > > ----------------------------------------------- > I don't believe this is a correct way to do this. > Please advise me, and tell me the better way. >
Currently you'd need to modify the source, as you've done above, because it always uses MBSTRING_ASC in req. There should really be a command line and config file option to do this, I'll look into adding that for OpenSSL 0.9.7. Steve. -- Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/ Personal Email: [EMAIL PROTECTED] Senior crypto engineer, Gemplus: http://www.gemplus.com/ Core developer of the OpenSSL project: http://www.openssl.org/ Business Email: [EMAIL PROTECTED] PGP key: via homepage. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
