<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<div>
<p dir="auto">For what it's worth, the strings we're having trouble with are in the pure ascii territory: no codepoints above 0x7f. They match exactly and do not differ in case. Ignoring the tag while comparing the strings would work fine in this case. I only mention the stringprep stuff because it's a clear indication that the spec expects implementations to deal with encodings and not just do straight binary compares, like GnuTLS is doing now.</p>
<p dir="auto">The cert validates just fine with OpenSSL. So I don't think "the generation should be fixed" is the right answer here—This is a consumption issue in GnuTLS. As far as I can tell, GnuTLS is deviating from the spec here, and not the library that created the cert. Therefore, arguing that they must change their code instead of fixing a compliance bug in GnuTLS is going to be a very hard sell.</p>
<p dir="auto">In our particular case, the CA and the created cert have different dn encodings because different tools created them. If the CA generation tools were java based everything would be UTF8Strings and it would work fine. It's kind of crazy to me that this hasn't come up yet, but maybe most people don't have heterogeneous tooling?</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #777;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/issues/553#note_101707949">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/sent_notifications/9b1aae5dee6d6001365fa4d39c88a22e/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/issues/553#note_101707949"}}</script>
</p>
</div>
</body>
</html>