<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>Am 12.02.2015 um 01:28 schrieb Dave Thompson <<a href="mailto:dthompson@prinpay.com">dthompson@prinpay.com</a>>:</div><div><br></div><div><blockquote type="cite">ASN1 strings set with the "generic" MBSTRING_ types that are for <br>known/standard OID-value pairs are constrained by tbl_standard in <br>asn1/a_strnid.c. A few like Country are forced to Printable as per standard.<br><br>Those standardized as DirectoryString are anded with a "default mask" then <br>a_mbstr.c chooses the "lowest" type supporting the characters in the value.<br>Which allowed *two* of the eight single-byte types (Teletex and Printable).<br>This is mentioned, very briefly, in the manpage for X509_NAME_add_entry.<br><br>1.0.1h in 2014 and later changed this mask to force UTF8 only, I believe <br>to implement the MUST UTF8 for DirectoryString's in 2459 and 3280, <br>even though 5280 in 2008 had relaxed it to MUST UTF8 OR Printable, <br>I suspect to be safe for implementations of the older standard.<br><br>req and ca override this by calling ASN1_STRING_set_default_mask_asc <br>with the (string) value of string_mask in the configuration if specified,<br>and <br>the supplied openssl.cnf back to 1.0.0 in 2009 set utf8only for those utils.<br>There is also a numeric version ASN1_STRING_set_default_mask .<br><br>HTH.</blockquote><br></div>Hi Dave,<div><br></div><div>thanks for your explanation. I wish these changes would have been documented somewhere in the version history of OpenSSL.</div><div><br></div><div>unsigned long defaultMask = ASN1_STRING_get_default_mask();<br>ASN1_STRING_set_default_mask (B_ASN1_PRINTABLESTRING);<br><br><div><div>...add entries…</div><div><br></div><div><div style="margin: 0px;"><font face="DejaVu Sans Mono">ASN1_STRING_set_default_mask (defaultMask);<br></font><br></div></div><div>seems to do the job.</div><div><br></div><div>Jörg</div></div></div></body></html>