<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
I can't speak intelligently to points 2-4, but as for #1, I get
cases all the time where the legal organization name exceeds 64
characters. In addition to Netherlands, which Jeremy has pointed
out, I see a lot from Germany, and given the unique method in the
German language of stringing together several existing words to form
a new word, things can get very long very quickly and are next to
impossible to sensibly abbreviate. Jeremy has pointed out a very
real problem here. I'm not necessarily advocating that we break
from 5280 on this, but I definitely think it is worth attempting to
update with PKIX/IETF.<br>
-Rich<br>
<br>
<div class="moz-cite-prefix">On 2/24/2016 2:01 PM, Jeremy Rowley
wrote:<br>
</div>
<blockquote
cite="mid:ffd904bd7d6c4677a014657dfb8c2fc0@EX2.corp.digicert.com"
type="cite">
<pre wrap="">Yes - I realize it is characters, not bytes. There are lots of examples in
Netherlands where the name is longer than 64 characters, especially if you
include all the legal identifiers.
Using SAN.dnsname only causes wonkiness in IE.
-----Original Message-----
From: Rob Stradling [<a class="moz-txt-link-freetext" href="mailto:rob.stradling@comodo.com">mailto:rob.stradling@comodo.com</a>]
Sent: Wednesday, February 24, 2016 12:56 PM
To: Jeremy Rowley; <a class="moz-txt-link-abbreviated" href="mailto:public@cabforum.org">public@cabforum.org</a>
Subject: Re: [cabfpub] RFC5280
On 24/02/16 18:56, Jeremy Rowley wrote:
<snip>
</pre>
<blockquote type="cite">
<pre wrap="">1)Org names, common names, and address fields are limited to 64
characters. Very few international companies can comply with this
restriction.
</pre>
</blockquote>
<pre wrap="">
Hi Jeremy. I'm puzzled as to why "international" would have anything to do
with this. Can you cite some examples of such international companies?
You do realize that the limit is in characters, not bytes, right?
</pre>
<blockquote type="cite">
<pre wrap="">It's even worse if you are converting an IDN to a printable string.
</pre>
</blockquote>
<pre wrap="">
If an IDN doesn't fit in a Subject.commonName, then you can omit the
Subject.commonName field from the cert.
Use SAN.dNSName.
--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
<br>
</body>
</html>