2

We are using Microsoft Certificate Request (CertReq.exe) to build certificate requests programmatically. For this purpose, we have to create input INF files, see docs here.

The Subject property is defined as Relative Distinguished Name string values, which should be encoded like specified by RFC 1779.

That essentially means to simply escape some characters (", +, ,, ;, <, >, or \) by prefixing it with \.

The problem is, that I could not figure out, how to properly encode a Subject that has the property "O=Foo + Bar".

Input (relevant INF part):

[NewRequest]
Subject = "CN=www.foo.de,OU=Foobar,O=Foo \+ Bar,L=Foo,S=Bar,C=DE"

Output:

The string contains an invalid X500 name attribute key, oid, value or delimiter. 0x80092023 (-2146885597 CRYPT_E_INVALID_X500_STRING)
c:\file_path.inf([NewRequest] Subject = "CN=www.foo.de,OU=Foobar,O=Foo \+ Bar,L=Foo,S=Bar,C=DE")

Duplicate escaping (using "and \) is discouraged by RFC 1799, but seems to solve problems in LDAP queries (see here, f.i.). However, we also tried do not use the quotation to specify a subject, but got another unwanted result.

Input:

[NewRequest]
Subject = CN=www.foo.de,OU=Foobar,O=Foo \+ Bar,L=Foo,S=Bar,C=DE

Output:

The data is invalid. 0x8007000d (WIN32: 13 ERROR_INVALID_DATA)
c:\file_path.inf([NewRequest] Subject = "CN=www.foo.de", "OU=Foobar", "O=Foo \+ Bar", "L=Foo", "S=Bar", "C=DE")

The whole process works without the + sign. What is the correct way to encode a RDN (relative distinguished name) in the INF file?

Community
  • 1
  • 1
gpinkas
  • 2,291
  • 2
  • 33
  • 49
  • Related; where there's a comma in the DN: https://social.technet.microsoft.com/Forums/windows/en-US/fa15d9ef-bd36-4fdd-86fc-9fa83417fc4c/how-to-insert-special-characters-in-dn?forum=winserversecurity – JohnLBevan Oct 06 '17 at 13:17

1 Answers1

1

Normally the + character has special meaning. You can disable that behavior like this and just use the + character like you would any other.

Subject = CN=www.foo.de,OU=Foobar,O=Foo + Bar,L=Foo,S=Bar,C=DE
X500NameFlags = 0x20000000

The plus character is normally reserved to separate multiple values for multi-valued RDNs.

I'm not entirely sure why escaping it does not work with CertEnroll as you are expecting it to.

vcsjones
  • 138,677
  • 31
  • 291
  • 286
  • That did it! There are other encoding issues, f.i. UTF-8 chars, escaping quotes, etc. but I'll start another question after experimenting with other X500NameFlags. – gpinkas Oct 15 '15 at 07:19
  • For documentation on X500NameFlags see https://msdn.microsoft.com/en-us/library/windows/desktop/aa379394%28v=vs.85%29.aspx – gpinkas Oct 15 '15 at 07:24