OpenSSL converting chars to UTF-8 literals

Question

I'm running a simple PKI web application in Php that uses OpenSSL shell commands and stores information in a text database. I have to deal with non-ASCII input characters (eg. German) but when a new cert is created, the fields turn into

[...] /C=DE/ST=H\xC3\xA4mburg/L=H\xC3\xA4mburg/O=\xC3\x9FBCD/OU=\xC3\xA4BC/ [...]

I've added

[req]
utf8                = yes
string_mask         = utf8only
name_opt            = multiline,-esc_msb,utf8

to the OpenSSL config files, and the certs are created using

openssl req -utf8 [...]
openssl ca -utf8 [...]

The program writes out temporary config files used to request and create the user cert. I've checked and the fields in the user config file are fine, as well as in the CA's. The problem appears when OpenSSL creates the certificates. The database and the certs contain these codes instead of the correct characters.

I also tried to convert the database file to UTF-8 using iconv but the file remains in US-ASCII format. This approach changes what file --mime-encoding outputs to utf-8, but OpenSSL continues to write new entries the same way as before.

I'll also mention I'm sending the utf-8 header and setting AddDefaultCharset utf-8 in virtualhosts. The locale is set to de_DE.utf8 in the code and on the server.

What am I missing? Any help is appreciated.

Answer 1

I was struggling with this for days aswell, finally got it working.

-utf8 on the commandline and utf8 = yes in the config seems a bit redundant.

I used -utf8 -nameopt multiline,utf8 on the commandline, i did'nt escape anything in the config file (I tried several versions of that but none worked) which says UTF-8 Unicode text when i run file <configfile>.

My locale and cli are configured to use utf-8 input and output, config is similar to:

[req]
prompt = no
distinguished_name = subject

[subject]
C = DE
ST = myutf8state
L = myutf8locality
O = myutf8organization
OU = myutf8organizational unit
CN = my.common.name

I found these 2 questions on stackoverflow to be of help:

• https://stackoverflow.com/questions/16478452/how-to-create-csr-with-utf8-subject-in-openssl#29649477
• https://stackoverflow.com/questions/23598872/how-to-create-ssl-certificate-with-unicode-characters-in-the-organization-name