error: ASN1_mbstring_ncopy:illegal characters

[raf]

On Tue, Apr 11, 2023 at 11:04:46PM -0400, Viktor Dukhovni <openssl-users at dukhovni.org> wrote:

> On Tue, Apr 11, 2023 at 11:40:10PM +1000, raf via openssl-users wrote:
> 
> > I'm trying to create a CSR for an SMIME certificate for
> > an email address with non-ASCII characters (localpart
> > and domain), and I'm getting this error after entering
> > äbç@être.org as the email address:
> 
> You can't do that with rfc822Name, its syntax is by definition
> restricted to printable ASCII (IA5String):
> 
>     https://datatracker.ietf.org/doc/html/rfc5280#page-38
> 
>         GeneralName ::= CHOICE {
>                 otherName                       [0]     OtherName,
>                 rfc822Name                      [1]     IA5String,
>                 dNSName                         [2]     IA5String,
>                 x400Address                     [3]     ORAddress,
>                 directoryName                   [4]     Name,
>                 ediPartyName                    [5]     EDIPartyName,
>                 uniformResourceIdentifier       [6]     IA5String,
>                 iPAddress                       [7]     OCTET STRING,
>                 registeredID                    [8]     OBJECT IDENTIFIER }
> 
>        OtherName ::= SEQUENCE {
>             type-id    OBJECT IDENTIFIER,
>             value      [0] EXPLICIT ANY DEFINED BY type-id }
> 
> To create certificates for non-ASCII email addresses you need:
> 
>     https://datatracker.ietf.org/doc/html/rfc8398#section-3
> 
>         id-on-SmtpUTF8Mailbox OBJECT IDENTIFIER ::= { id-on 9 }
>         SmtpUTF8Mailbox ::= UTF8String (SIZE (1..MAX))
> 
> -- 
>     Viktor.

Hi Viktor,

Thanks. I thought that might be the case, but I didn't
know what kind of encoding was appropriate for openssl
usage. There are different encodings for different
purposes. My interest in Unicode domain names relates
to DNS usage where IDNA2008/UTC#46 is useful. But this
makes sense since it's an email address.

It would be great if openssl performed the necessary
encoding, especially when it has been instructed (with
the -utf8 option) to interperet input as UTF-8 (but the
locale should probably be enough of an indication), and
to also perform the corresponding decoding on output. I
think that requiring users to perform the correct
encoding is asking too much. But maybe expecting
openssl to include code for encoding and decoding email
addresses is asking too much.

I have a shell script that will need to decode
international email addresses in S/MIME certificates,
and then encode the domain as IDNA2008/UTC#46.

Does anyone know of a readily available command line
tool that can decode international email addresses?

cheers,
raf