Subject: [pkix] IDNA2008 and PKIX certificates

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Tue, 22 Nov 2016 11:02:11 +0100

Hi,
 RFC5280 and its update (6818), reference IDNA2003 (rfc3490) for
storing internationalized DNS names. However, IDNA2003 is already
obsolete standard (it seems it was already deprecated when RFC6818 was
published [0]) and in practice phased out. What is the current best
practice on internationalized names with certificates?

Is it transparently switch to IDNA2008 (rfc5890), and let software
figure out the reverse mappings to utf8 somehow?

Or is it store UTF-8 dns names on the certificate, and let the software
comparing DNS names do any mapping it deems necessary prior to
comparison?

regards,
Nikos

[0]. https://www.ietf.org/mail-archive/web/pkix/current/msg28386.html

---

From: Sean Turner <[email-masked]>
Date: Wed, 23 Nov 2016 05:57:23 -0500

Nikos,

I asked about this in 2011 and here’s the response I got from an “apps” person (shared with permission):

spt

> On Apr 13, 2011, at 14:51, Pete Resnick <[email-masked]> wrote:
> 
>> I'm curious if there's something that lists the differences between the IDNA 2003 and 2008 for a layman. I've got a WG that wants to update the references, but I don't think it's just as easy as that.
> 
> It is most certainly *not* as easy as that. You could send them to RFC 5894, but that's not a list of differences; it's an entirely new design philosophy. If you've got a WG that wants to update references, send them to PRECIS. We're here to help.™
> 
> pr

> On Nov 22, 2016, at 05:02, Nikos Mavrogiannopoulos <[email-masked]> wrote:
> 
> Hi,
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Wed, 23 Nov 2016 12:51:14 +0100

Thank you Sean. Should I forward the initial question to the precis
working group? (or at least a version of the question which asks their
recommendation).

On Wed, 2016-11-23 at 05:57 -0500, Sean Turner wrote:
> > > I'm curious if there's something that lists the differences
> > > between the IDNA 2003 and 2008 for a layman. I've got a WG that
> > > wants to update the references, but I don't think it's just as
> > > easy as that.
> > 
> > It is most certainly *not* as easy as that. You could send them to
> > RFC 5894, but that's not a list of differences; it's an entirely
> > new design philosophy. If you've got a WG that wants to update
> > references, send them to PRECIS. We're here to help.™
> > 
> > pr
> 
> 
> > 
> > On Nov 22, 2016, at 05:02, Nikos Mavrogiannopoulos <[email-masked]
> > > wrote:
> > 
> > Hi,

---

From: Sean Turner <[email-masked]>
Date: Wed, 23 Nov 2016 12:27:25 -0500

Yes because if anybody is going to be able to answer the question it’ll be them.

spt

> On Nov 23, 2016, at 06:51, Nikos Mavrogiannopoulos <[email-masked]> wrote:
>