Ia5String support

Question

Ia5String support

darkseid-is opened this issue 9 months ago · comments

darkseid-is commented 9 months ago

Add support for Ia5String in Distinguished Name. Thank you.

Dirkjan Ochtman · Answer 1 · Fri Oct 27 2023 21:03:40 GMT+0800 (China Standard Time)

What's your use case? Why do you need this?

darkseid-is · Answer 2 · Fri Oct 27 2023 21:15:29 GMT+0800 (China Standard Time)

Trying to create CertificateParams using from_ca_cert_der. The existing certificate contains subject in Ia5String format. Thank You.

Dirkjan Ochtman · Answer 3 · Fri Oct 27 2023 21:28:37 GMT+0800 (China Standard Time)

Why is it important to you that the generated certificate has the same type as the existing certificate?

darkseid-is · Answer 4 · Fri Oct 27 2023 21:35:37 GMT+0800 (China Standard Time)

The type doesn't matter , but https://docs.rs/rcgen/latest/rcgen/struct.CertificateParams.html#method.from_ca_cert_der fails to parse the certificate if subject is of type Ia5String.

Daniel McCarney · Answer 5 · Fri Oct 27 2023 22:22:16 GMT+0800 (China Standard Time)

Can you share the certificate? I would expect most certificate subjects to contain organization names, or common names, and those are defined in RFC 5280 as choices of string types that don't include Ia5String. Does the subject contain something unusual like a DomainComponent or is it misencoded?

darkseid-is · Answer 6 · Fri Oct 27 2023 22:51:27 GMT+0800 (China Standard Time)

Here is the certificate

Daniel McCarney · Answer 7 · Fri Oct 27 2023 23:06:41 GMT+0800 (China Standard Time)

Thanks!

It's the emailAddress attribute in the subject causing trouble:

      SET {
        SEQUENCE {
          # emailAddress
          OBJECT_IDENTIFIER { 1.2.840.113549.1.9.1 }
          IA5String { "contact@www.webhosting.htb" }
        }
      }

5280 mentions:

Implementers should note that the at sign ('@') and underscore ('_')
characters are not supported by the ASN.1 type PrintableString.
These characters often appear in Internet addresses.  Such addresses
MUST be encoded using an ASN.1 type that supports them.  They are
usually encoded as IA5String in either the emailAddress attribute
within a distinguished name or the rfc822Name field of GeneralName.

I believe IA5String is equivalent to ASCII so I think it would be feasible to implement support without too much work.

Daniel McCarney · Answer 8 · Sat Oct 28 2023 04:27:29 GMT+0800 (China Standard Time)

@darkseid-is with the code in #182 I'm able to use CertificateParams::from_ca_cert_der with your example certificate without error.

Daniel McCarney · Answer 9 · Mon Oct 30 2023 22:49:09 GMT+0800 (China Standard Time)

This is fixed in the main branch.

darkseid-is · Answer 10 · Mon Oct 30 2023 23:29:00 GMT+0800 (China Standard Time)

Thanks for the fix guys.