Subject: Re: [Spasm] IDNA2008 and PKIX certificates

From: Russ Housley <[email-masked]>
Date: Mon, 19 Dec 2016 12:17:44 -0500

Nikos:

RFC 5280 only needs to convert to punycode.  The punycode form is
carried in certificate, and the punycode form is used to compare two
domain names.

RFC 5280 refers to Section 4 of RFC 3490 for the conversion.  In
addition, Section 7.2 of RFC 5280 provides some guidance about the flags
used in that process.

RFC 5891 also referes to RFC 3490 for the conversion to punycode.

I don't see a problem with RFC 5280 with respect to IDNA.

Russ

On Nov 25, 2016, at 3:35 AM, Nikos Mavrogiannopoulos <[email-masked]> wrote:

> Hi,
>  RFC5280 and its update (6818), reference IDNA2003 (rfc3490) for
> storing internationalized DNS names. However, IDNA2003 is already
> obsolete standard (it seems it was already deprecated when RFC6818 was
> published [0]), in practice phased out, and incompatible with IDNA2008.
> My understanding is that the situation with internationalized names in
> certificates/https is not at a good state (you are lucky if it works).
> 
> Is there some plan to update RFC5280 to fix that situation? an example
> would be to switch to IDNA2008 and to the corresponding ToUnicode
> operation for the reverse mapping.
> 
> regards,
> Nikos
> 
> 
> PS. Originally posted in PKIX-list and precis groups.

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 19 Dec 2016 17:33:32 +0000

Hi Russ,

> I don't see a problem with RFC 5280 with respect to IDNA.
I think RFC 5280 should be updated to say that RFC 5891 applies. This is 
not a big update, but it needs doing.

Best Regards,
Alexey
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm