Subject: Re: [pkix] [Spasm] IDNA2008 and PKIX certificates

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Mon, 02 Jan 2017 15:55:02 +0100

On Mon, 2016-12-19 at 12:17 -0500, Russ Housley wrote:
> Nikos:
> 
> RFC 5280 only needs to convert to punycode.  The punycode form is
> carried in certificate, and the punycode form is used to compare two
> domain names.
> RFC 5280 refers to Section 4 of RFC 3490 for the conversion.  In
> addition, Section 7.2 of RFC 5280 provides some guidance about the
> flags
> used in that process.

You may be right. The "obsoleted by" header in the referenced rfc3490,
is probably sufficient.

regards,
Nikos

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Tue, 03 Jan 2017 10:07:37 +0100

On Mon, 2017-01-02 at 15:55 +0100, Nikos Mavrogiannopoulos wrote:
> > carried in certificate, and the punycode form is used to compare
> > two domain names.

Note that RFC5280 requires the reverse too. Section 7.2 says
"Implementations should convert IDNs to Unicode before display."
and that's a valid requirement. The punycode is not human readable.

> You may be right. The "obsoleted by" header in the referenced
> rfc3490, is probably sufficient.

However, that leaves an transitional use such TR46 [0] as an
exercise to the reader.

regards,
Nikos

[0]. http://unicode.org/reports/tr46/