From: Job Snijders <job@bsd.nl>
Subject: rpki-client: reject non-PrintableString subjects
To: tech@openbsd.org
Date: Sun, 20 Sep 2026 16:58:53 +0000

Dear all,

AfriNIC completed their project to reissue all non-conformant
certificates about a month ago: https://lists.afrinic.net/pipermail/dbwg/2026-August/000582.html

It should be noted that at the moment of writing there still is a very
small contingent of CAs that ought to reissue some signed objects. This
can be traced back to behaviour in some versions of krill Krill that
will byte-for-byte reflect the subject as designated by the issuer
even if the issuer used an invalid encoding. This came to light after
a regression in APNIC's signer system. Between January 28th, 2026 and
March 3rd, 2026 APNIC inadvertently issued resource certificates with
UTF8String-encoded issuers & subjects (instead of PrintableString).
APNIC resolved the incident and revoked/reissued all nonconforming
certificates under APNIC's control, and Krill instances seem to slowly
be picking up the rectification. https://github.com/NLnetLabs/krill/issues/1394

Time to tighten the thumbscrews. OK?

Kind regards,

Job

Index: x509.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/x509.c,v
diff -u -p -r1.134 x509.c
--- x509.c	26 Aug 2026 05:42:42 -0000	1.134
+++ x509.c	20 Sep 2026 16:43:27 -0000
@@ -376,17 +376,10 @@ valid_printable_string(const char *fn, c
 	const unsigned char *data;
 	int i, length;
 
-	/*
-	 * This warning should be an error by default (not gated behind -vv).
-	 * https://lists.afrinic.net/pipermail/dbwg/2023-March/000436.html
-	 * https://lists.afrinic.net/pipermail/dbwg/2025-November/000546.html
-	 */
-	if (verbose > 1 && ASN1_STRING_type(as) != V_ASN1_PRINTABLESTRING) {
+	if (ASN1_STRING_type(as) != V_ASN1_PRINTABLESTRING) {
 		warnx("%s: RFC 6487 section 4.5: %s commonName is"
 		    " not PrintableString", fn, descr);
-#if 0
 		return 0;
-#endif
 	}
 
 	data = ASN1_STRING_get0_data(as);