
From nobody Wed Nov 23 07:19:45 2016
Return-Path: <nmav@redhat.com>
X-Original-To: precis@ietfa.amsl.com
Delivered-To: precis@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD61A129A15 for <precis@ietfa.amsl.com>; Wed, 23 Nov 2016 07:19:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -8.399
X-Spam-Level: 
X-Spam-Status: No, score=-8.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-1.497, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1-phkZtpiBp4 for <precis@ietfa.amsl.com>; Wed, 23 Nov 2016 07:19:41 -0800 (PST)
Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E850129A07 for <precis@ietf.org>; Wed, 23 Nov 2016 07:19:41 -0800 (PST)
Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 015B080088 for <precis@ietf.org>; Wed, 23 Nov 2016 15:19:41 +0000 (UTC)
Received: from dhcp-10-40-1-102.brq.redhat.com ([10.40.2.184]) by int-mx14.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id uANFJd9W003185 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for <precis@ietf.org>; Wed, 23 Nov 2016 10:19:40 -0500
Message-ID: <1479914378.2765.2.camel@redhat.com>
From: Nikos Mavrogiannopoulos <nmav@redhat.com>
To: precis@ietf.org
Date: Wed, 23 Nov 2016 16:19:38 +0100
References: <1479808931.31825.10.camel@redhat.com>
Content-Type: multipart/mixed; boundary="=-2AiXDgGkiJCqz7OTDMG9"
Mime-Version: 1.0
X-Scanned-By: MIMEDefang 2.68 on 10.5.11.27
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Wed, 23 Nov 2016 15:19:41 +0000 (UTC)
Archived-At: <https://mailarchive.ietf.org/arch/msg/precis/xNq9skelj2TEw3z_2mEaCXPmqfw>
Subject: [precis] [Fwd: [pkix] IDNA2008 and PKIX certificates]
X-BeenThere: precis@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Preparation and Comparison of Internationalized Strings <precis.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/precis>, <mailto:precis-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/precis/>
List-Post: <mailto:precis@ietf.org>
List-Help: <mailto:precis-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/precis>, <mailto:precis-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Nov 2016 15:19:43 -0000

--=-2AiXDgGkiJCqz7OTDMG9
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit

Hi,
 I sent the attached message originally in pkix list. It seems that
PKIX (X.509) certificates are currently stuck with IDNA2003, making the
HTTPS situation quite confusing, since most browsers and registrars use
IDNA2008 for DNS. Is there any suggestion on how this situation can be
addressed?

regards,
Nikos

--=-2AiXDgGkiJCqz7OTDMG9
Content-Disposition: inline
Content-Description: Forwarded message - [pkix] IDNA2008 and PKIX
 certificates
Content-Type: message/rfc822

Return-Path: pkix-bounces@ietf.org
Received: from zmta01.collab.prod.int.phx2.redhat.com (LHLO
 zmta01.collab.prod.int.phx2.redhat.com) (10.5.81.8) by
 zmail22.collab.prod.int.phx2.redhat.com with LMTP; Tue, 22 Nov 2016
 05:02:43 -0500 (EST)
Received: from int-mx13.intmail.prod.int.phx2.redhat.com
 (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) by
 zmta01.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 987B818648E
 for <nmavrogi@mail.corp.redhat.com>; Tue, 22 Nov 2016 05:02:43 -0500 (EST)
Received: from mx1.redhat.com (ext-mx06.extmail.prod.ext.phx2.redhat.com
 [10.5.110.30]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4)
 with ESMTP id uAMA2hjB012540 (version=TLSv1/SSLv3
 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for <nmav@redhat.com>;
 Tue, 22 Nov 2016 05:02:43 -0500
Received: from mail.ietf.org (mail.ietf.org [4.31.198.44])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mx1.redhat.com (Postfix) with ESMTPS id 1E8D843A2C
	for <nmav@redhat.com>; Tue, 22 Nov 2016 10:02:38 +0000 (UTC)
Received: from ietfa.amsl.com (localhost [IPv6:::1])
	by ietfa.amsl.com (Postfix) with ESMTP id 909A8129D10;
	Tue, 22 Nov 2016 02:02:35 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1;
	t=1479808956; bh=LKDt9LyJ6soiEU44KksPgPvwxD3WfBHARI/eDoVgkZ4=;
	h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:
	 List-Post:List-Help:List-Subscribe;
	b=mudtf6oeoLgCl+YJvisyHPY7ghmLyhYVkgL+QesUF+IN+rZQLFq/uhsItvcvbh0xb
	 mXG5pNEkNnPgmCFdRatfTGVRp1FXtvY5femlP5utbjxRJjj3paiiPvYITx+BtzXbcp
	 tPuFz4ZC21JyKv6WklO5n+Dbtg7iVTRcBEEVnQCU=
X-Original-To: pkix@ietfa.amsl.com
Delivered-To: pkix@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1])
 by ietfa.amsl.com (Postfix) with ESMTP id 90EBC129D00
 for <pkix@ietfa.amsl.com>; Tue, 22 Nov 2016 02:02:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Level: 
X-Spam-Status: No, score=-8.399 tagged_above=-999 required=5
 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-1.497,
 SPF_HELO_PASS=-0.001, SPF_PASS=-0.001]
 autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44])
 by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id UxrDDJ9DlMZr for <pkix@ietfa.amsl.com>;
 Tue, 22 Nov 2016 02:02:31 -0800 (PST)
Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by ietfa.amsl.com (Postfix) with ESMTPS id 7FB2C129D0B
 for <pkix@ietf.org>; Tue, 22 Nov 2016 02:02:14 -0800 (PST)
Received: from int-mx14.intmail.prod.int.phx2.redhat.com
 (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by mx1.redhat.com (Postfix) with ESMTPS id 2409881231
 for <pkix@ietf.org>; Tue, 22 Nov 2016 10:02:14 +0000 (UTC)
Received: from dhcp-10-40-1-102.brq.redhat.com ([10.40.2.184])
 by int-mx14.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id
 uAMA2COG010996
 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO)
 for <pkix@ietf.org>; Tue, 22 Nov 2016 05:02:13 -0500
Message-ID: <1479808931.31825.10.camel@redhat.com>
From: Nikos Mavrogiannopoulos <nmav@redhat.com>
To: pkix@ietf.org
Date: Tue, 22 Nov 2016 11:02:11 +0100
Mime-Version: 1.0
X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26
X-Scanned-By: MIMEDefang 2.68 on 10.5.11.27
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16
 (mx1.redhat.com [10.5.110.25]); Tue, 22 Nov 2016 10:02:14 +0000 (UTC)
Archived-At:  <https://mailarchive.ietf.org/arch/msg/pkix/tqExjIhAUNtDqZlpe8UGJpjAgq4>
Subject: [pkix] IDNA2008 and PKIX certificates
X-BeenThere: pkix@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: PKIX Working Group <pkix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/pkix>,
 <mailto:pkix-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/pkix/>
List-Post: <mailto:pkix@ietf.org>
List-Help: <mailto:pkix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pkix>,
 <mailto:pkix-request@ietf.org?subject=subscribe>
Content-Type: text/plain; charset="utf-8"
Errors-To: pkix-bounces@ietf.org
Sender: "pkix" <pkix-bounces@ietf.org>
X-Greylist: Sender passed SPF test, Sender IP whitelisted by DNSRBL, ACL
 199 matched, not delayed by milter-greylist-4.5.16 (mx1.redhat.com
 [10.5.110.30]); Tue, 22 Nov 2016 10:02:38 +0000 (UTC)
X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com
 [10.5.110.30]); Tue, 22 Nov 2016 10:02:38 +0000 (UTC) for IP:'4.31.198.44'
 DOMAIN:'mail.ietf.org' HELO:'mail.ietf.org' FROM:'pkix-bounces@ietf.org'
 RCPT:''
X-RedHat-Spam-Score: -4.798 
 (BAYES_50,DCC_REPUT_00_12,DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H2,RP_MATCHES_RCVD,SPF_PASS)
 4.31.198.44 mail.ietf.org 4.31.198.44 mail.ietf.org <pkix-bounces@ietf.org>
X-Scanned-By: MIMEDefang 2.78 on 10.5.110.30
Content-Transfer-Encoding: 8bit

Hi,
 RFC5280 and its update (6818), reference IDNA2003 (rfc3490) for
storing internationalized DNS names. However, IDNA2003 is already
obsolete standard (it seems it was already deprecated when RFC6818 was
published [0]) and in practice phased out. What is the current best
practice on internationalized names with certificates?

Is it transparently switch to IDNA2008 (rfc5890), and let software
figure out the reverse mappings to utf8 somehow?

Or is it store UTF-8 dns names on the certificate, and let the software
comparing DNS names do any mapping it deems necessary prior to
comparison?

regards,
Nikos

[0]. https://www.ietf.org/mail-archive/web/pkix/current/msg28386.html

_______________________________________________
pkix mailing list
pkix@ietf.org
https://www.ietf.org/mailman/listinfo/pkix

--=-2AiXDgGkiJCqz7OTDMG9--


From nobody Wed Nov 23 07:29:59 2016
Return-Path: <alexey.melnikov@isode.com>
X-Original-To: precis@ietfa.amsl.com
Delivered-To: precis@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9763129A2A for <precis@ietfa.amsl.com>; Wed, 23 Nov 2016 07:29:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.497
X-Spam-Level: 
X-Spam-Status: No, score=-3.497 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isode.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cxrgb6EjzOyD for <precis@ietfa.amsl.com>; Wed, 23 Nov 2016 07:29:56 -0800 (PST)
Received: from statler.isode.com (Statler.isode.com [62.232.206.189]) by ietfa.amsl.com (Postfix) with ESMTP id E8B4912965E for <precis@ietf.org>; Wed, 23 Nov 2016 07:29:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1479914995; d=isode.com; s=june2016; i=@isode.com; bh=+DJ0drUcnrm5GGAyvjdbQVrKjA5bvmpNQ1TBceGeq9o=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=IDm57JZzqMwWedhPpbYpbq3Sg3f9MaA1hJKObPQHnAcfGA4BiRt9pE6QKwbXDqsBqAPf6c 5kdMwYnpW6vfGs0vyK8b9CH/nhvkQzGb58dbLgpZDr2fi5L5Aim1nkDJbKoRWqbrp1mh/z hXYacXCEGFehEeLrcNxsBFBRMFAiLx4=;
Received: from [172.20.1.215] (dhcp-215.isode.net [172.20.1.215])  by statler.isode.com (submission channel) via TCP with ESMTPSA  id <WDW18gAY10J9@statler.isode.com>; Wed, 23 Nov 2016 15:29:55 +0000
To: Nikos Mavrogiannopoulos <nmav@redhat.com>, precis@ietf.org
References: <1479808931.31825.10.camel@redhat.com> <1479914378.2765.2.camel@redhat.com>
From: Alexey Melnikov <alexey.melnikov@isode.com>
Message-ID: <a474552c-9225-dcbc-9221-d23bbdd6f6b7@isode.com>
Date: Wed, 23 Nov 2016 15:29:00 +0000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0
In-Reply-To: <1479914378.2765.2.camel@redhat.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="------------86104757911FD174A183B8D2"
Archived-At: <https://mailarchive.ietf.org/arch/msg/precis/4-5lM3yq6dBzAho8gu93xPiSUR8>
Subject: Re: [precis] [Fwd: [pkix] IDNA2008 and PKIX certificates]
X-BeenThere: precis@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Preparation and Comparison of Internationalized Strings <precis.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/precis>, <mailto:precis-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/precis/>
List-Post: <mailto:precis@ietf.org>
List-Help: <mailto:precis-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/precis>, <mailto:precis-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Nov 2016 15:29:58 -0000

This is a multi-part message in MIME format.
--------------86104757911FD174A183B8D2
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit

Hi Nikos,

You might want to email the LAMPS WG (spasm@ietf.org) asking about this.

On 23/11/2016 15:19, Nikos Mavrogiannopoulos wrote:
> Hi,
>   I sent the attached message originally in pkix list. It seems that
> PKIX (X.509) certificates are currently stuck with IDNA2003, making the
> HTTPS situation quite confusing, since most browsers and registrars use
> IDNA2008 for DNS. Is there any suggestion on how this situation can be
> addressed?

>
> regards,
> Nikos
>
>
> _______________________________________________
> precis mailing list
> precis@ietf.org
> https://www.ietf.org/mailman/listinfo/precis


--------------86104757911FD174A183B8D2
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta content="text/html; charset=windows-1252"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <p>Hi Nikos,<br>
    </p>
    You might want to email the LAMPS WG (<a class="moz-txt-link-abbreviated" href="mailto:spasm@ietf.org">spasm@ietf.org</a>) asking about
    this.<br>
    <br>
    <div class="moz-cite-prefix">On 23/11/2016 15:19, Nikos
      Mavrogiannopoulos wrote:<br>
    </div>
    <blockquote cite="mid:1479914378.2765.2.camel@redhat.com"
      type="cite">
      <pre wrap="">Hi,
 I sent the attached message originally in pkix list. It seems that
PKIX (X.509) certificates are currently stuck with IDNA2003, making the
HTTPS situation quite confusing, since most browsers and registrars use
IDNA2008 for DNS. Is there any suggestion on how this situation can be
addressed?</pre>
    </blockquote>
    <br>
    <blockquote cite="mid:1479914378.2765.2.camel@redhat.com"
      type="cite">
      <pre wrap="">

regards,
Nikos
</pre>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
precis mailing list
<a class="moz-txt-link-abbreviated" href="mailto:precis@ietf.org">precis@ietf.org</a>
<a class="moz-txt-link-freetext" href="https://www.ietf.org/mailman/listinfo/precis">https://www.ietf.org/mailman/listinfo/precis</a>
</pre>
    </blockquote>
    <br>
  </body>
</html>

--------------86104757911FD174A183B8D2--


From nobody Wed Nov 23 07:52:49 2016
Return-Path: <john-ietf@jck.com>
X-Original-To: precis@ietfa.amsl.com
Delivered-To: precis@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C1DC129A05 for <precis@ietfa.amsl.com>; Wed, 23 Nov 2016 07:52:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.397
X-Spam-Level: 
X-Spam-Status: No, score=-3.397 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.497] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iMhsvrtStdlr for <precis@ietfa.amsl.com>; Wed, 23 Nov 2016 07:52:45 -0800 (PST)
Received: from bsa2.jck.com (ns.jck.com [70.88.254.51]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D4E7129E3E for <precis@ietf.org>; Wed, 23 Nov 2016 07:52:05 -0800 (PST)
Received: from [198.252.137.10] (helo=JcK-HP8200) by bsa2.jck.com with esmtp (Exim 4.82 (FreeBSD)) (envelope-from <john-ietf@jck.com>) id 1c9Zq6-000MSu-Sb; Wed, 23 Nov 2016 10:52:02 -0500
Date: Wed, 23 Nov 2016 10:51:57 -0500
From: John C Klensin <john-ietf@jck.com>
To: Nikos Mavrogiannopoulos <nmav@redhat.com>
Message-ID: <F04F5141033B22C123F856F5@JcK-HP8200>
In-Reply-To: <1479914378.2765.2.camel@redhat.com>
References: <1479808931.31825.10.camel@redhat.com> <1479914378.2765.2.camel@redhat.com>
X-Mailer: Mulberry/4.0.8 (Win32)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
X-SA-Exim-Connect-IP: 198.252.137.10
X-SA-Exim-Mail-From: john-ietf@jck.com
X-SA-Exim-Scanned: No (on bsa2.jck.com); SAEximRunCond expanded to false
Archived-At: <https://mailarchive.ietf.org/arch/msg/precis/Ag58aXtTQxu88n3YKP8yluxPbXY>
Cc: precis@ietf.org
Subject: Re: [precis] [Fwd: [pkix] IDNA2008 and PKIX certificates]
X-BeenThere: precis@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Preparation and Comparison of Internationalized Strings <precis.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/precis>, <mailto:precis-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/precis/>
List-Post: <mailto:precis@ietf.org>
List-Help: <mailto:precis-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/precis>, <mailto:precis-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Nov 2016 15:52:46 -0000

Nikos,

Follow Alexey's advice about where to take this -- LAMPS should
have constructive suggestions.  However, the evidence I've seen
suggests that, while most registrars use IDNA2008 as you note,
many or most browsers are still using IDNA2003 or some hybrid
involving IDNA2003, UTR46, and, sometimes, unofficial (and
inconsistent) versions of Stringprep modified to reflect some or
all Unicode versions since 3.2.

That makes many situations, not just HTTPS, quite confusing.

Free advice:

(1) Assume there will be no mapping.   Use only labels
consisting of "final" codepoints, i.e., in IDNA2008 terminology.
the decoded form of each label in a domain name must be either
an LDH-label or a U-label 

(2) Use domain names that are valid under both IDNA2003 and
IDNA2008.  That, unfortunately, limits you to Unicode 3.2
because IDNA2003 does not allow later versions to be used to
create labels to be stored in the DNS.

If you follow both rules in your choice of domains, you should
be safe and behavior should be predictable unless you use a
string that IDNA2008 considers a valid U-label but that contains
characters that IDNA2003 and/or UTR46 map to different
characters.  If you need to violate either rule, or use one of
the three characters referred to in the previous sentence,
expect confusion and possible bad results.

If what you intend to put in the certificates are non-ASCII
email addresses rather than just domain names, things are even
more complicated and confusing.  Best to take that up in LAMPS
as well.

If you want someone to complain to about this situation, I'm
sure someone on this list can point you to appropriate parties.
:-(

Good luck.
    john




--On Wednesday, November 23, 2016 16:19 +0100 Nikos
Mavrogiannopoulos <nmav@redhat.com> wrote:

> Hi,
>  I sent the attached message originally in pkix list. It seems
> that PKIX (X.509) certificates are currently stuck with
> IDNA2003, making the HTTPS situation quite confusing, since
> most browsers and registrars use IDNA2008 for DNS. Is there
> any suggestion on how this situation can be addressed?
> 
> regards,
> Nikos





From nobody Wed Nov 30 15:17:11 2016
Return-Path: <internet-drafts@ietf.org>
X-Original-To: precis@ietf.org
Delivered-To: precis@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C502129B2D; Wed, 30 Nov 2016 15:17:08 -0800 (PST)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: internet-drafts@ietf.org
To: <i-d-announce@ietf.org>
X-Test-IDTracker: no
X-IETF-IDTracker: 6.39.0
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <148054782830.9698.11273240446787978217.idtracker@ietfa.amsl.com>
Date: Wed, 30 Nov 2016 15:17:08 -0800
Archived-At: <https://mailarchive.ietf.org/arch/msg/precis/RewkQOv5NWnz_jS7b2My5dCca2U>
Cc: precis@ietf.org
Subject: [precis] I-D Action: draft-ietf-precis-7564bis-04.txt
X-BeenThere: precis@ietf.org
X-Mailman-Version: 2.1.17
List-Id: Preparation and Comparison of Internationalized Strings <precis.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/precis>, <mailto:precis-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/precis/>
List-Post: <mailto:precis@ietf.org>
List-Help: <mailto:precis-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/precis>, <mailto:precis-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 30 Nov 2016 23:17:08 -0000

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Preparation and Comparison of Internationalized Strings of the IETF.

        Title           : PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols
        Authors         : Peter Saint-Andre
                          Marc Blanchet
	Filename        : draft-ietf-precis-7564bis-04.txt
	Pages           : 40
	Date            : 2016-11-30

Abstract:
   Application protocols using Unicode code points in protocol strings
   need to properly handle such strings in order to enforce
   internationalization rules for strings placed in various protocol
   slots (such as addresses and identifiers) and to perform valid
   comparison operations (e.g., for purposes of authentication or
   authorization).  This document defines a framework enabling
   application protocols to perform the preparation, enforcement, and
   comparison of internationalized strings ("PRECIS") in a way that
   depends on the properties of Unicode code points and thus is more
   agile with respect to versions of Unicode.  As a result, this
   framework provides a more sustainable approach to the handling of
   internationalized strings than the previous framework, known as
   Stringprep (RFC 3454).  This document obsoletes RFC 7564.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-precis-7564bis/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-precis-7564bis-04

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-precis-7564bis-04


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


From nobody Wed Nov 30 15:17:15 2016
Return-Path: <internet-drafts@ietf.org>
X-Original-To: precis@ietf.org
Delivered-To: precis@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 46236129B2D; Wed, 30 Nov 2016 15:17:09 -0800 (PST)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: internet-drafts@ietf.org
To: <i-d-announce@ietf.org>
X-Test-IDTracker: no
X-IETF-IDTracker: 6.39.0
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <148054782928.9646.15697678779298434519.idtracker@ietfa.amsl.com>
Date: Wed, 30 Nov 2016 15:17:09 -0800
Archived-At: <https://mailarchive.ietf.org/arch/msg/precis/1TirL0qXaSEfS50RBxClBsdD6yU>
Cc: precis@ietf.org
Subject: [precis] I-D Action: draft-ietf-precis-7613bis-04.txt
X-BeenThere: precis@ietf.org
X-Mailman-Version: 2.1.17
List-Id: Preparation and Comparison of Internationalized Strings <precis.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/precis>, <mailto:precis-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/precis/>
List-Post: <mailto:precis@ietf.org>
List-Help: <mailto:precis-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/precis>, <mailto:precis-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 30 Nov 2016 23:17:09 -0000

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Preparation and Comparison of Internationalized Strings of the IETF.

        Title           : Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords
        Authors         : Peter Saint-Andre
                          Alexey Melnikov
	Filename        : draft-ietf-precis-7613bis-04.txt
	Pages           : 24
	Date            : 2016-11-30

Abstract:
   This document describes updated methods for handling Unicode strings
   representing usernames and passwords.  The previous approach was
   known as SASLprep (RFC 4013) and was based on stringprep (RFC 3454).
   The methods specified in this document provide a more sustainable
   approach to the handling of internationalized usernames and
   passwords.  The preparation, enforcement, and comparison of
   internationalized strings (PRECIS) framework, RFC 7564, obsoletes RFC
   3454, and this document obsoletes RFC 7613.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-precis-7613bis/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-precis-7613bis-04

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-precis-7613bis-04


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


From nobody Wed Nov 30 15:17:27 2016
Return-Path: <internet-drafts@ietf.org>
X-Original-To: precis@ietf.org
Delivered-To: precis@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 11D60129BD2; Wed, 30 Nov 2016 15:17:12 -0800 (PST)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: internet-drafts@ietf.org
To: <i-d-announce@ietf.org>
X-Test-IDTracker: no
X-IETF-IDTracker: 6.39.0
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <148054783206.9586.3310186699218164822.idtracker@ietfa.amsl.com>
Date: Wed, 30 Nov 2016 15:17:12 -0800
Archived-At: <https://mailarchive.ietf.org/arch/msg/precis/hUUjqg7rty9z0wZHSVk8t87pr-o>
Cc: precis@ietf.org
Subject: [precis] I-D Action: draft-ietf-precis-7700bis-04.txt
X-BeenThere: precis@ietf.org
X-Mailman-Version: 2.1.17
List-Id: Preparation and Comparison of Internationalized Strings <precis.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/precis>, <mailto:precis-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/precis/>
List-Post: <mailto:precis@ietf.org>
List-Help: <mailto:precis-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/precis>, <mailto:precis-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 30 Nov 2016 23:17:12 -0000

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Preparation and Comparison of Internationalized Strings of the IETF.

        Title           : Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames
        Author          : Peter Saint-Andre
	Filename        : draft-ietf-precis-7700bis-04.txt
	Pages           : 11
	Date            : 2016-11-30

Abstract:
   This document describes methods for handling Unicode strings
   representing memorable, human-friendly names (called "nicknames",
   "display names", or "petnames") for people, devices, accounts,
   websites, and other entities.  This document obsoletes RFC 7700.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-precis-7700bis/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-precis-7700bis-04

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-precis-7700bis-04


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


From nobody Wed Nov 30 15:22:18 2016
Return-Path: <stpeter@stpeter.im>
X-Original-To: precis@ietfa.amsl.com
Delivered-To: precis@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C990D1294FD for <precis@ietfa.amsl.com>; Wed, 30 Nov 2016 15:22:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.798
X-Spam-Level: 
X-Spam-Status: No, score=-4.798 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KgUIg1_16eDb for <precis@ietfa.amsl.com>; Wed, 30 Nov 2016 15:22:14 -0800 (PST)
Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id 839201293F0 for <precis@ietf.org>; Wed, 30 Nov 2016 15:22:14 -0800 (PST)
Received: from aither.local (unknown [76.25.4.24]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 66C0040347; Wed, 30 Nov 2016 16:23:03 -0700 (MST)
To: "precis@ietf.org" <precis@ietf.org>
From: Peter Saint-Andre <stpeter@stpeter.im>
Message-ID: <dae73572-8377-0cea-b3c9-9f8ab283926a@stpeter.im>
Date: Wed, 30 Nov 2016 16:22:12 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:45.0) Gecko/20100101 Thunderbird/45.5.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/precis/8sSW2_iStcfeRfO1i52NyZjCNI0>
Subject: [precis] updated I-Ds
X-BeenThere: precis@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Preparation and Comparison of Internationalized Strings <precis.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/precis>, <mailto:precis-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/precis/>
List-Post: <mailto:precis@ietf.org>
List-Help: <mailto:precis-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/precis>, <mailto:precis-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 30 Nov 2016 23:22:16 -0000

I have just submitted version -04 of the PRECIS revisions with some 
relatively small fixes to terminology and such. I shall post to this 
list soon regarding some much more knotty issues.

Peter

