[BUG / possible BUG] Invalid JSON in cert_caIssuers

[pboguslawski]

UTF-8 chars in cert_caIssuers are broken in JSON output; i.e. for CA name

C=PL, O=Paweł, CN=Test

JSON output contains

                           },{
                                "id"           : "clientAuth_CA_list",
                                "severity"     : "INFO",
                                "finding"      : "CN=Test,O=Pawe\C5\82,C=PL"
                           },{

but should contain ł instead of \C5\82.

Removing -nameopt RFC2253 resolves this issue for us (testssl installed in Debian 13 from testssl.sh package).

[drwetter]

Hi @pboguslawski ,
thanks!

Removing -nameopt RFC2253 resolves this issue for us

That can't be just removed as it escapes control and other non-printable chars , but it also does utf-8 encoding,see e.g. https://docs.openssl.org/3.1/man1/openssl-namedisplay-options/#description . As the polish ł is printable I need to dig a bit deeper why it ends up in JSON encoded. I suppose, the terminal output is fine?

[pboguslawski]

As the polish ł is printable I need to dig a bit why it ends up in JSON encoded.

Probably because LDAP encoded (RFC2253) clientAuth_CA_list is not decoded by testssl to UTF-8 when printing to stdout/json. Not just JSON output is invalid; also stdout gets

CA List for Client Auth     [...]C582[...]

instead of

CA List for Client Auth     [...]ł[...]

I suppose, the terminal output is fine?

Problem is not connected with terminal settings but (probably) with invalid encoding/decoding workflow for clientAuth_CA_list in testssl (i.e. for terminal and json output). Problem does not occur in cert_caIssuers field where no RFC2253 encoding is used (ł char in issuers name is processed correctly there for stdout/json).

[dcooper16]

I haven't done any testing with testssl.sh, but I tested several versions of OpenSSL and LibreSSL, and got the same results for all:

> openssl x509 -in cert.pem -issuer -noout -nameopt RFC2253
issuer=CN=www.example.fr,O=Soci\C3\A9t\C3\A9,L=Paris,ST=\C3\8Ele-de-France,C=FR

> openssl x509 -in cert.pem -issuer -noout -nameopt RFC2253,-esc_msb
issuer=CN=www.example.fr,O=Société,L=Paris,ST=Île-de-France,C=FR

It has been a long time since I looked at UTF-8, so I don't know whether removing esc_msb is safe. Are there any non-printable characters other than the ones that are part of ASCII?

[drwetter]

It has been a long time since I looked at UTF-8, so I don't know whether removing esc_msb is safe. Are there any non-printable characters other than the ones that are part of ASCII?

Good approach(!) and good question. I would assume if the output environment is utf-8 too it should be fine. If not, it probably depends.