Request for enhancement about DER encoding consistency and UTF-8 support in DN
for CSR, subject DN, issue DN, user provided subject DN, User Subject Name
Default, ideas on how the agent interface could alter or correct the DN
encoding.


RFC5280 Section 4.1.2.6 states:

" a) When the subject of the certificate is a CA, the subject field MUST be
encoded in the same way as it is encoded in the issuer field (Section 4.1.2.4)
in all certificates issued by the subject CA.  Thus, if the subject CA encodes
attributes in the issuer fields of certificates that it issues using the
TeletexString, BMPString, or UniversalString encodings, then the subject field
of certificates issued to that CA MUST use the same encoding."

Note these deprecated string types are cited to emphasize the need to encode
the subject DN in CA certificate same way as the CA encodes them as issuer DN
in certificates it issues.
"


Here are some snips of what I could find from RFC5280
(http://www.ietf.org/rfc/rfc5280.txt)

Section "4.1.2.4. Issuer"

The DirectoryString type is defined as a choice of PrintableString,
TeletexString, BMPString, UTF8String, and UniversalString.  CAs conforming to
this profile MUST use either the PrintableString or UTF8String encoding of
DirectoryString, with two exceptions.

Certificate users MUST be prepared to process the issuer distinguished name and
subject distinguished name (Section 4.1.2.6) fields to perform name chaining
for certification path validation (Section 6).  Name chaining is performed by
matching the issuer distinguished name in one certificate with the subject name
in a CA certificate.  Rules for comparing distinguished names are specified in
Section 7.1.  If the names in the issuer and subject field in a certificate
match according to the rules specified in Section 7.1, then the certificate is
self-issued.

Section "4.1.2.6. Subject"

The subject field is defined as the X.501 type Name. Implementation
requirements for this field are those defined for the issuer field (Section
4.1.2.4).  Implementations of this specification MUST be prepared to receive
subject names containing the attribute types required for the issuer field.

When encoding attribute values of type DirectoryString, conforming CAs MUST use
PrintableString or UTF8String encoding, with the following exceptions...

Section "7.1.  Internationalized Names in Distinguished Names"

Representation of internationalized names in distinguished names is covered in
Sections 4.1.2.4, Issuer Name, and 4.1.2.6, Subject Name. Standard naming
attributes, such as common name, employ the DirectoryString type, which
supports internationalized names through a variety of language encodings.
Conforming implementations MUST support UTF8String and PrintableString.  RFC
3280 required only binary comparison of attribute values encoded in
UTF8String,...


And finally...

Appendix A.  Pseudo-ASN.1 Structures and OIDs
A.1.  Explicitly Tagged Module, 1988 Syntax

X520CommonName ::= CHOICE {
      teletexString     TeletexString   (SIZE (1..ub-common-name)),
      printableString   PrintableString (SIZE (1..ub-common-name)),
      universalString   UniversalString (SIZE (1..ub-common-name)),
      utf8String        UTF8String      (SIZE (1..ub-common-name)),
      bmpString         BMPString       (SIZE (1..ub-common-name)) }


X520OrganizationName ::= CHOICE {
      teletexString     TeletexString   (SIZE (1..ub-organization-name)),
      printableString   PrintableString (SIZE (1..ub-organization-name)),
      universalString   UniversalString (SIZE (1..ub-organization-name)),
      utf8String        UTF8String      (SIZE (1..ub-organization-name)),
      bmpString         BMPString       (SIZE (1..ub-organization-name))  }


X520OrganizationalUnitName ::= CHOICE {
      teletexString     TeletexString   (SIZE
(1..ub-organizational-unit-name)),
      printableString   PrintableString (SIZE
(1..ub-organizational-unit-name)),
      universalString   UniversalString (SIZE
(1..ub-organizational-unit-name)),
      utf8String        UTF8String      (SIZE
(1..ub-organizational-unit-name)),
      bmpString         BMPString       (SIZE (1..ub-organizational-unit-name))
}


X520countryName ::=     PrintableString (SIZE (2)) (digraph from IS 3166)


In particular, Appendix A clearly shows that C has to be PrintableString, but
CN,OU,O can be UTF8String or PrintableString, so the CA should support a
mixture of encodings and not just one encoding for the entire DN.

Perhaps the Agent Approval page can render a series of drop-downs (similar to
key usage).

Then the agent approval page can render the DN as a series of drop-downs with the encoding type to use for each DN component this (instead of just one
fluid text box).

From what I see in the documentation (B.1.20 and B.1.25), the "User
Subject Name Default" extension should preserve the subject DN from the request
where the "Subject Name Default" extension should be server-side configurable.
I assume this is most appropriate to go in the "User Subject Name Default"
extension.