Re: [Spasm] IDNA2008 and PKIX certificates

Nikos Mavrogiannopoulos <[email protected]>
Newsgroups gmane.ietf.x509
Message-ID <[email protected]>
On Mon, 2017-01-02 at 15:55 +0100, Nikos Mavrogiannopoulos wrote:
> On Mon, 2016-12-19 at 12:17 -0500, Russ Housley wrote:
> > Nikos:
> > 
> > RFC 5280 only needs to convert to punycode.  The punycode form is
> > carried in certificate, and the punycode form is used to compare
> > two domain names.

Note that RFC5280 requires the reverse too. Section 7.2 says
"Implementations should convert IDNs to Unicode before display."
and that's a valid requirement. The punycode is not human readable.

> > RFC 5280 refers to Section 4 of RFC 3490 for the conversion.  In
> > addition, Section 7.2 of RFC 5280 provides some guidance about the
> > flags
> > used in that process.
> 
> You may be right. The "obsoleted by" header in the referenced
> rfc3490, is probably sufficient.

However, that leaves an transitional use such TR46 [0] as an
exercise to the reader.

regards,
Nikos

[0]. http://unicode.org/reports/tr46/

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.