Dear Maintainer,


First, the problem is not from the machine this bug report is sent from,
but from one running the same Debian release.


We have a java web application that runs in tomcat and has done so for
several years without major changes. The application uses X509
certificates for authentication. It compares subject and issuer DN of
the client certificate presented in the SSL handshake with stored
values. Many of the certificate subject DNs contain utf-8 encoded
characters as per RFC2253.
All this has worked for many years up until and including
openjdk 21.0.8+9-1 (and also 17.0.16+8-1).

After upgrading to openjdk 21.0.9+10-1~deb13u1 (or
17.0.17+10-1~deb12u1), the DN attribute returned by
X509Certificate.getSubjectX500Principal().getName() is
misencoded:

Subject DN: /C=CH/ST=BE/O=xfer.ch/OU=IT Security/CN=\xC3\x9Cm
L\xC3\xA4ut/emailAddress=umlaut@xfer.ch

Decoded correctly with openjdk version "21.0.8" 2025-07-15 (build
21.0.8+9-Debian-1):
C=CH,O=xfer.ch,OU=IT Security,CN=Üm Läut,EMAILADDRESS=umlaut@xfer.ch

Decoded incorrectly with openjdk version "21.0.9" 2025-10-21 (build
21.0.9+10-Debian-1deb13u1):
C=CH,O=xfer.ch,OU=IT Security,CN=Ãm Läut,EMAILADDRESS=umlaut@xfer.ch

In this case, the CN contains german umlauts: CN=Üm Läut, which are
encoded according to RFC2253 in the certificate.

It seems as if the DerValue returned from AVA.parseString() has a wrong
tag value set there (i.e. none or DerValue.tag_IA5String instead of
DerValue.tag_UTF8String).

The X509Certificate class and the other classes involved are part of the
standard JRE.

I do not know if this behaviour is specific to Debian.
There were changes to certificate handling in the latest openjdk update
(especially JDK-8360937 and JDK-8359454), but those are not publicly
accessible.

Thanks for looking into this!

Best regards

Markus

How to reproduce:

1) Compile the attached file CertificateParser.java with "javac
CertificateParser.java"

2) Create directory "parseCertificate" and copy the
CertificateParser.class file from 1) to it

3) Copy the attached file umlaut@xfer.ch.crt to the current working
directory

4) Run "java -cp . parseCertificate.CertificateParser
umlaut@xfer.ch.crt", one time with openjdk 21.0.8+9-1, the other time
with openjdk 21.0.9+10-1 (or with openjdk 17.0.16+8-1 and 17.0.17+10-1)



Results:
Java 17:
openjdk 17.0.16+8-1:
# java -cp . parseCertificate.CertificateParser umlaut@xfer.ch.crt
Java version: 17.0.16 (Debian)
Certificate subject DN:
1.2.840.113549.1.9.1=#160e756d6c61757440786665722e6368,CN=Üm Läut,OU=IT
Security,O=xfer.ch,ST=BE,C=CH
Certificate subject DN (RFC 1779):
OID.1.2.840.113549.1.9.1=umlaut@xfer.ch, CN=Ãm Läut, OU=IT Security,
O=xfer.ch, ST=BE, C=CH
Certificate subject DN (RFC 2253):
1.2.840.113549.1.9.1=#160e756d6c61757440786665722e6368,CN=Üm Läut,OU=IT
Security,O=xfer.ch,ST=BE,C=CH
Certificate subject DN (canonical):
1.2.840.113549.1.9.1=#160e756d6c61757440786665722e6368,cn=#1409c39c6d204cc3a47574,ou=it
security,o=xfer.ch,st=be,c=ch

openjdk 17.0.17+10-1:
# java -cp . parseCertificate.CertificateParser umlaut@xfer.ch.crt
Java version: 17.0.17 (Debian)
Certificate subject DN:
1.2.840.113549.1.9.1=#160e756d6c61757440786665722e6368,CN=Ãm Läut,OU=IT
Security,O=xfer.ch,ST=BE,C=CH
Certificate subject DN (RFC 1779):
OID.1.2.840.113549.1.9.1=umlaut@xfer.ch, CN=Ãm Läut, OU=IT Security,
O=xfer.ch, ST=BE, C=CH
Certificate subject DN (RFC 2253):
1.2.840.113549.1.9.1=#160e756d6c61757440786665722e6368,CN=Ãm Läut,OU=IT
Security,O=xfer.ch,ST=BE,C=CH
Certificate subject DN (canonical):
1.2.840.113549.1.9.1=#160e756d6c61757440786665722e6368,cn=#1409c39c6d204cc3a47574,ou=it
security,o=xfer.ch,st=be,c=ch


Java 21:
openjdk 21.0.8+9-1:
# java -cp . parseCertificate.CertificateParser umlaut@xfer.ch.crt
Java version: 21.0.8 (Debian)
Certificate subject DN:
1.2.840.113549.1.9.1=#160e756d6c61757440786665722e6368,CN=Üm Läut,OU=IT
Security,O=xfer.ch,ST=BE,C=CH
Certificate subject DN (RFC 1779):
OID.1.2.840.113549.1.9.1=umlaut@xfer.ch, CN=Ãm Läut, OU=IT Security,
O=xfer.ch, ST=BE, C=CH
Certificate subject DN (RFC 2253):
1.2.840.113549.1.9.1=#160e756d6c61757440786665722e6368,CN=Üm Läut,OU=IT
Security,O=xfer.ch,ST=BE,C=CH
Certificate subject DN (canonical):
1.2.840.113549.1.9.1=#160e756d6c61757440786665722e6368,cn=#1409c39c6d204cc3a47574,ou=it
security,o=xfer.ch,st=be,c=ch

openjdk 21.0.9+10-1:
# java -cp . parseCertificate.CertificateParser umlaut@xfer.ch.crt
Java version: 21.0.9 (Debian)
Certificate subject DN:
1.2.840.113549.1.9.1=#160e756d6c61757440786665722e6368,CN=Ãm Läut,OU=IT
Security,O=xfer.ch,ST=BE,C=CH
Certificate subject DN (RFC 1779):
OID.1.2.840.113549.1.9.1=umlaut@xfer.ch, CN=Ãm Läut, OU=IT Security,
O=xfer.ch, ST=BE, C=CH
Certificate subject DN (RFC 2253):
1.2.840.113549.1.9.1=#160e756d6c61757440786665722e6368,CN=Ãm Läut,OU=IT
Security,O=xfer.ch,ST=BE,C=CH
Certificate subject DN (canonical):
1.2.840.113549.1.9.1=#160e756d6c61757440786665722e6368,cn=#1409c39c6d204cc3a47574,ou=it
security,o=xfer.ch,st=be,c=ch


Best
Markus

Dear Maintainer/s

Please let me know if there is anything else I can do to help with
resolving this issue.

I just tried with openjdk-25-jre, and it shows the same erroneous behaviour.

Then I downloaded openjdk-25.0.1 from https://jdk.java.net/25. Also same
behaviour.

So the problem does not seem to be Debian specific. Should I open a bug
upstream?

Best regards

Markus