Use utf8 string for private key subject with non-printable characters #710
Conversation
nssdb/keys.go
Outdated
| var printableRx = regexp.MustCompile(`^[a-zA-Z0-9 '()+,\-.\\:=?]*$`) | ||
|
|
||
| func isPrintable(s string) bool { | ||
| return printableRx.MatchString(s) | ||
| } |
There was a problem hiding this comment.
Is this a limitation of nssdb?
The unicode package has a method for validating whether a run is printable IsPrint(rune). Some more complicated limitations can be done using the In(r rune, ranges ...*RangeTable) function, for example, to limit the runes to be in the Latin RangeTable, or you can also create your own.
There was a problem hiding this comment.
This refers to the asn.1 type of printable strings, which is more restrictive than the unicode IsPrint function. In a certificate where the common name contains only printable characters it's encoded with the asn1 tag for PrintableString. For anything else it gets the asn1 tag for UTF8String. (At least that's how it works for our certificates.)
There was a problem hiding this comment.
Looping runes will perform better:
Lines 183 to 213 in 9fd47c3
Go ans1 loops around bytes using a similar method, this is for one byte https://github.com/golang/go/blob/f24b299df2896a4e8a80863dbb55a264f4b9bb68/src/encoding/asn1/asn1.go#L422-L444
When importing a private key into an NSS database with a certificate, the certificate common name is used as the value of the CKA_SUBJECT attribute on the key object. This fixes the serialization to work when the CN contains characters that aren't valid for the asn1 printable string type.
💔Thank you!