Re: [Spasm] IDNA2008 and PKIX certificates
Nikos Mavrogiannopoulos <[email protected]>
| Newsgroups | gmane.ietf.x509 |
|---|---|
| Message-ID | <[email protected]> |
On Mon, 2017-01-02 at 15:55 +0100, Nikos Mavrogiannopoulos wrote: > On Mon, 2016-12-19 at 12:17 -0500, Russ Housley wrote: > > Nikos: > > > > RFC 5280 only needs to convert to punycode. The punycode form is > > carried in certificate, and the punycode form is used to compare > > two domain names. Note that RFC5280 requires the reverse too. Section 7.2 says "Implementations should convert IDNs to Unicode before display." and that's a valid requirement. The punycode is not human readable. > > RFC 5280 refers to Section 4 of RFC 3490 for the conversion. In > > addition, Section 7.2 of RFC 5280 provides some guidance about the > > flags > > used in that process. > > You may be right. The "obsoleted by" header in the referenced > rfc3490, is probably sufficient. However, that leaves an transitional use such TR46 [0] as an exercise to the reader. regards, Nikos [0]. http://unicode.org/reports/tr46/ _______________________________________________ pkix mailing list [email protected] https://www.ietf.org/mailman/listinfo/pkix