| Previous | Next |
| CRYPT_E_INVALID_PRINTABLE_STRING | CRYPT_E_INVALID_X500_STRING |
CRYPT_E_INVALID_IA5_STRING
IA5String carries only 7-bit characters
CRYPT_E_INVALID_IA5_STRING occurs when CryptoAPI is asked to encode an ASN.1 IA5String containing a character above U+007F. IA5String is frequently used for DNS names, URI values, and legacy email-address forms in certificate extensions, but it does not directly carry arbitrary Unicode text.
Internationalized domain names normally require conversion to an ASCII-compatible form before they are placed in an IA5String field. For X.500 RDNs, the right answer may instead be UTF8String. The correct repair depends on the field's ASN.1 schema; replacing bytes without understanding that schema can produce a certificate that encodes successfully but represents the wrong identity.
Diagnosis
- Find the first character with a code point above 127.
- Determine whether the field is a DNS name, URI, email address, or RDN value.
- Apply IDNA/Punycode only to fields whose profile defines that representation.
- Keep raw Unicode in UTF8String-capable fields instead of lossy ASCII transliteration.
References
- Microsoft: CertStrToName and internationalized RDN handling
- Microsoft: certificate enrollment string types
- RFC 5280: name forms in X.509 certificates
Looking for a different code? Search another status or error code.