CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/20 14:04:03
Modified files:
usr.sbin/rpki-client: x509.c
Log message:
Reject non-conformant certificate subject encodings
Background:
Even though RFC 6487 section 4 is clear: "The CommonName attribute MUST
be encoded using the ASN.1 type PrintableString", some large CAs for
many years incorrectly issued certificates with UTF8String encodings
owing to a documentation bug in OpenSSL:
https://github.com/openssl/openssl/pull/23699
AfriNIC recently announced the completion of a multi-year project to
reissue all non-conformant certificates, see their final update here:
https://lists.afrinic.net/pipermail/dbwg/2026-August/000582.html
This work cleared a major hurdle for RP implementations to impose
stricter validation, in turn positively impacting the overall ecosystem
because requirement baselining and adherence to standards leads to
improved interoperability.
It should be noted that at the moment of writing there still is a very
small contingent of CAs (less than a handful) that ought to reissue some
signed objects. This can be traced back to behaviour in some versions
of Krill that byte-for-byte reflect the subject as designated by the
issuer, even when the issuer used an invalid encoding. This came to
light after a regression in APNIC's signer system. Between 28-Jan-2026
and 03-Mar-2026, APNIC inadvertently issued resource certificates with
UTF8String-encoded issuers & subjects (instead of PrintableString).
APNIC resolved the incident by revoking/reissuing all nonconforming
certificates under APNIC's control. Affected Krill instances seem to be
picking up the rectification. For more information see:
https://github.com/NLnetLabs/krill/issues/1394
"yes please" tb@
