Subject: DN Encoding by UTF8String

From: Masaki SHIMAOKA <[email-masked]>
Date: Fri, 05 Dec 2003 16:09:10 +0900

Dear Authors and WG Chairs,

RFC3280 mentioned that "all certificates issued after Dec 31, 2003 MUST
use UTF8String encoding".

However, it seems that some applications do not yet support UTF8String
respectably and the detail of name comparison rule does not consider
UTF8String sufficiently.

Therefore, existing CAs using except UTF8String for DN encoding SHOULD
do the following actions until solving these UTF8String problem.

    An encoding for issuer field of the certificates issued after 2004
    SHOULD be same as an encoding for subject field of CA certificate
    already issued.

Is this correct?

Of course, when the UTF8String problem solves, all certificates
issuedMUST use UTF8String encoding.
I worry that some confused CAs issue wrong certificates using UTF8String
encoding forcibly, even though the CA had used another encoding till now.

Best regards,
-----
Masaki SHIMAOKA

SECOM Trust.net
System Engineering Dpt.
Tel: +81 422 91 8498 (ext.3605)
Fax: +81 422 45 0536
e-mail: [email-masked]

---

From: [email-masked] (Peter Gutmann)
Date: Fri, 5 Dec 2003 22:12:10 +1300

Masaki SHIMAOKA <[email-masked]> writes:

>Of course, when the UTF8String problem solves, all certificates issuedMUST
>use UTF8String encoding.

I was actually going to save this for 1/1/04 (since I get to ask it before
anyone else does), but as a follow-up to the above I may as well ask it now:

  How many CAs are actually going to switch their certs to UTF8 next month?
  Anyone?

Peter.