In theory, names in X509 certs are defined as:

  teletexString     TeletexString   (SIZE (1..ub-state-name)),
  printableString   PrintableString (SIZE (1..ub-state-name)),
  universalString   UniversalString (SIZE (1..ub-state-name)),
  utf8String        UTF8String      (SIZE (1..ub-state-name)),
  bmpString         BMPString       (SIZE(1..ub-state-name)) }

But what's the current state of certificates in the world? Everything I've seen so far uses just UTF8String for all the fields.

I'm writing a service for signing recent CSRs generated of new Linux systems, used in internal networks only - not in the wild. Is there any risk in always outputting UTF8String in the signed requests and dropping any CSR which isn't using that encoding?


The answer is actually included in RFC 4630 and various later ones. It looks like 2003 was the last year when other encodings were relevant. These days UTF8String (or potentially PrintableString) are the answer.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.