Hi,
I'm trying to create a CSR for an SMIME certificate for
an email address with non-ASCII characters (localpart
and domain), and I'm getting this error after entering
äbç@être.org as the email address:
139749651649856:error:0D07A07C:asn1 encoding routines:ASN1_mbstring_ncopy:illegal characters:../crypto/asn1/a_mbstr.c:115:
The error message is similar if the only non-ASCII
characters are in the domain name, or if they are only
in the localpart (only the leading number in the error
message changes). It's just for testing purposes, and
I'm only really interested in the domain part.
I must be doing something wrong. How can I use
non-ASCII (UTF8-encoded Unicode characters,
LANG=en_AU.UTF-8)? It looks like it's expecting
multi-byte strings (a_mbstr.c).
My smime.cnf contains:
[req]
distinguished_name = req_distinguished_name
[req_distinguished_name]
countryName = Country Name (2 letter code)
countryName_default = AU
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = Some-State
localityName = Locality Name (eg, city)
0.organizationName = Organization Name (eg, company)
0.organizationName_default = Internet Widgits Pty Ltd
organizationalUnitName = Organizational Unit Name (eg, section)
commonName = Common Name (e.g. server FQDN or YOUR name)
commonName_max = 64
emailAddress = Email Address
emailAddress_max = 64
[smime]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
subjectAltName = email:copy
extendedKeyUsage = emailProtection
And the openssl commands were:
OPENSSL_CONF=`pwd`/smime.cnf
# Generate an RSA Private Key for the Certificate Authority
openssl genrsa -aes256 -out ca.key 2048
# Create Self-Signed Certificate for the Certificate Authority
openssl req -new -x509 -days 365 -key ca.key -out ca.crt
# Generate an RSA Private Key for the Personal E-Mail Certificate
openssl genrsa -aes256 -out smime_test_user.key 2048
# Create the Certificate Signing Request
openssl req -new -key smime_test_user.key -out smime_test_user.csr
The error happened during the command above.
> openssl req -new -key smime_test_user.key -out smime_test_user.csr
Enter pass phrase for smime_test_user.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:äbç@être.org
problems making Certificate Request
139749651649856:error:0D07A07C:asn1 encoding routines:ASN1_mbstring_ncopy:illegal characters:../crypto/asn1/a_mbstr.c:115:
So I didn't get to the final command:
# Sign the Certificate Using the Certificate Authority
openssl x509 -req -days 365 -in smime_test_user.csr -CA ca.crt -CAkey ca.key -set_serial 1 -out smime_test_user.crt -addtrust emailProtection -addreject clientAuth -addreject serverAuth -trustout -extfile smime.cnf -extensions smime
cheers,
raf
