Dear colleagues,

I'm happy to let you know that the support of RFC 8398 "Internationalized Email Addresses in X.509 Certificates" is just committed to the OpenSSL master branch. This support will go public in OpenSSL 3.0 (hopefully later this year).

The work was originally done with the support of CCTLD RU/РФ. Special thanks to Maria Kolesnikova!

On Wed, Jul 3, 2019 at 8:54 PM Dmitry Belyavsky <beldmit@gmail.com> wrote:

Hi all,

Coordination Center for TLD .RU/.РФ is happy to announce a draft implementation of RFC 8398 "Internationalized Email Addresses in X.509 Certificates" for OpenSSL: https://cctld.ru/en/news/news_detail.php?ID=21240

The implementation and some test examples are available for download here: https://cctld.ru/files/books/EAI.pdf (in Russian)

Direct links:

Draft implementation - https://cctld.ru/files/eai/rfc8398.diff
Test examples - https://cctld.ru/files/eai/root.tar.gz
Instructions - https://cctld.ru/files/eai/README.8398

The implementation covers the following cases:
- Displaying the EAI in X.509 certificates
- Verifying NameConstraints in X.509 certificate chains of trust
- Matching EAIs in X.509 with provided EAI.

Feel free to test the patch and send feedback to pr@cctld.ru or to me directly.

--
SY, Dmitry Belyavsky