From 5a2bb54bbb7b68a7407ab5d62c828c329166bd81 Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Mon, 19 Oct 2015 23:45:59 -0500 Subject: encode countryName with PrintableString This commit adds a dependency on asn1crypto for testing purposes to parse the certificate and confirm that countryName is encoded with PrintableString while other fields are UTF8String. This is a test only dep. --- src/cryptography/hazmat/backends/openssl/backend.py | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) (limited to 'src') diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py index f86c3aa1..db7022e5 100644 --- a/src/cryptography/hazmat/backends/openssl/backend.py +++ b/src/cryptography/hazmat/backends/openssl/backend.py @@ -52,7 +52,7 @@ from cryptography.hazmat.primitives.ciphers.algorithms import ( from cryptography.hazmat.primitives.ciphers.modes import ( CBC, CFB, CFB8, CTR, ECB, GCM, OFB ) -from cryptography.x509.oid import ExtensionOID +from cryptography.x509.oid import ExtensionOID, NameOID _MemoryBIO = collections.namedtuple("_MemoryBIO", ["bio", "char_ptr"]) @@ -119,12 +119,14 @@ def _encode_name(backend, attributes): for attribute in attributes: value = attribute.value.encode('utf8') obj = _txt2obj_gc(backend, attribute.oid.dotted_string) + if attribute.oid == NameOID.COUNTRY_NAME: + # Per RFC5280 countryName should be encoded as PrintableString, + # not UTF8String + type = backend._lib.MBSTRING_ASC + else: + type = backend._lib.MBSTRING_UTF8 res = backend._lib.X509_NAME_add_entry_by_OBJ( - subject, - obj, - backend._lib.MBSTRING_UTF8, - value, - -1, -1, 0, + subject, obj, type, value, -1, -1, 0, ) backend.openssl_assert(res == 1) return subject -- cgit v1.2.3 From 8fdd1d3a00ea2c1de04a214314e20a39009c7c29 Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Tue, 27 Oct 2015 11:35:37 +0900 Subject: update comment to include a bit more detail --- src/cryptography/hazmat/backends/openssl/backend.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py index db7022e5..775430d4 100644 --- a/src/cryptography/hazmat/backends/openssl/backend.py +++ b/src/cryptography/hazmat/backends/openssl/backend.py @@ -120,8 +120,8 @@ def _encode_name(backend, attributes): value = attribute.value.encode('utf8') obj = _txt2obj_gc(backend, attribute.oid.dotted_string) if attribute.oid == NameOID.COUNTRY_NAME: - # Per RFC5280 countryName should be encoded as PrintableString, - # not UTF8String + # Per RFC5280 Appendix A.1 countryName should be encoded as + # PrintableString, not UTF8String type = backend._lib.MBSTRING_ASC else: type = backend._lib.MBSTRING_UTF8 -- cgit v1.2.3