Just a quick heads up that a couple of new RFCs[1][2] update RFC 5280 w.r.t. i18n support. [1] https://tools.ietf.org/html/rfc8398 [2] https://tools.ietf.org/html/rfc8399 The most notable change is a new otherName type to represent internationalised email addresses (i.e. when the local part is not ASCII). I have filed a ticket[3] to support this in FreeIPA (no Dogtag changes are needed). I don't think it is urgent, but eventually someone will ask for it. [3] https://pagure.io/freeipa/issue/7564 Thanks, Fraser