Subject: [Spasm] IDNA2008 and PKIX certificates

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Fri, 25 Nov 2016 09:35:29 +0100

Hi,
 RFC5280 and its update (6818), reference IDNA2003 (rfc3490) for
storing internationalized DNS names. However, IDNA2003 is already
obsolete standard (it seems it was already deprecated when RFC6818 was
published [0]), in practice phased out, and incompatible with IDNA2008.
My understanding is that the situation with internationalized names in
certificates/https is not at a good state (you are lucky if it works).

Is there some plan to update RFC5280 to fix that situation? an example
would be to switch to IDNA2008 and to the corresponding ToUnicode
operation for the reverse mapping.

regards,
Nikos

PS. Originally posted in PKIX-list and precis groups.