Suppose I control the international domain name (IDN) münchen.example.com
(xn--mnchen-3ya.example.com
).
Now, I want to get a SSL certificate for this domain name to enable HTTPS for my web site. I have decided which CA to use, I've jumped through all the necessary initial hoops as far as they are concerned, and I'm all but ready to send in a certificate signing request. There is only one small matter left to clear up:
Given that the FQDN has multiple possible representations, what, exactly, goes into the certificate signing request (CSR)'s Common Name (CN) field?
- The Unicode domain name (or rather fully-qualified host name)? (In which case, using what Unicode encoding? UTF-8, to maintain ASCII binary compatibility?)
- The Punycode-encoded fully-qualified host name?
- Something else? (What?)
- CA-dependent?
Bonus points for answers that also address web browser compatibility with the described scheme.