Forum Discussion
Determining encoding schemes of SSL traffic Certifcates
When our servers would authenticate
to certain mobile users (specifically Android), the "CommonName" attribute appears mangled. According to our security review team, this is due to the fact
that the CommonName field is encoded using BMPString which according to RFC
2459 is deprecated:
“The UTF8String encoding is the
preferred encoding, and all certificates issued after December
31, 2003 MUST use the UTF8String encoding of DirectoryString (except
as noted below). “
I have
attempted to determine what encoding schemes our certificates use according to this reference
without much success:
http://www.novell.com/support/kb/doc.php?id=3369938
In reviewing
the output below, I see no mention of UTF8 or any other encoding
scheme. Does anyone have any thoughts
concerning how we might establish which encoding
scheme is being employed or what clues I might be overlooking in the
(sanitized), output below?
tmp openssl asn1parse -inform DER -in ws.example.com.der
0:d=0 hl=4 l=1108 cons:
SEQUENCE
4:d=1
hl=4 l= 828 cons:
SEQUENCE
8:d=2
hl=2 l= 3 cons: cont [ 0
]
10:d=3
hl=2 l= 1 prim:
INTEGER :02
13:d=2 hl=2 l= 17 prim: INTEGER
:8A6CBD017E6BB38DC6DA228E3B211727
32:d=2 hl=2 l= 13 cons:
SEQUENCE
34:d=3
hl=2 l= 9 prim:
OBJECT
:sha1WithRSAEncryption
45:d=3 hl=2 l= 0 prim:
NULL
47:d=2
hl=2 l= 88 cons: SEQUENCE
49:d=3
hl=2 l= 27 cons:
SET
51:d=4
hl=2 l= 25 cons:
SEQUENCE
53:d=5
hl=2 l= 3 prim:
OBJECT
:organizationName
58:d=5 hl=2 l= 18 prim: PRINTABLESTRING :Example, Inc
78:d=3 hl=2 l= 33 cons:
SET
80:d=4
hl=2 l= 31 cons:
SEQUENCE
82:d=5
hl=2 l= 3 prim:
OBJECT
:organizationalUnitName
87:d=5 hl=2 l= 24 prim: PRINTABLESTRING :Example, Inc Certificate Services
113:d=3 hl=2 l= 22 cons:
SET
115:d=4
hl=2 l= 20 cons:
SEQUENCE
117:d=5
hl=2 l= 3 prim:
OBJECT
:commonName
122:d=5 hl=2 l= 13 prim: PRINTABLESTRING :Example SSL
CA v1
137:d=2 hl=2 l= 30 cons:
SEQUENCE
tmp
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com