IDN Support enabled

Issuance Policy
1

I’m pleased to announce that Let’s Encrypt now supports issuance for Internationalized Domain Names (IDNs).

Note that the currently-released Certbot version (0.9.2) has a built-in check that prevents issuance for IDNs. To issue certificates with Certbot that contain IDNs, you can follow the developer instructions to install the latest development version. Or you can wait for the next Certbot release, currently planned for end of October / early November, or use an alternate client.

Let’s Encrypt (and the ACME protocol) accept IDNs only as A-labels (ASCII labels, starting with xn--, also known as Punycode), not as U-labels (Unicode labels). You can convert between U-labels and A-labels using https://github.com/bestiejs/punycode.js/ or https://www.punycoder.com/. Note that https://www.punycoder.com/ supports the older IDNA the older IDNA2003 spec, while Boulder implements the newer IDNA2008 spec, and so may reject some names converted by that site.

Also note that registries impose some limits on what IDNs may be registered, and browsers impose additional constraints on which IDNs will be represented in their U-label form. If you are thinking of purchasing a domain name, you should ensure it will render the way you want on the browsers that you care about.

15 Likes
2

Thanks!!! Works like a charm for me!

It’s great that it was enabled before the deadline!

3

When it will be possible to use it? I upgrade let’s encrypt repo and still can’t use it :-/

4

The CA servers are already issuing IDN certificates. As for clients, if you’re using certbot, you’ll need to switch to a development version as described here. Note that this is not the same thing as just running git pull for your local clone - that’ll still give you the released version of certbot, which does not support IDNs yet. Using one of the alternative clients might work too (not sure which of them support IDNs already).

1 Like
5
6

acme.sh supports IDN now.

2 Likes
7

I tested “getssl” today and it worked fine using the PunyCode version of my IDN domain.

2 Likes
8

IDN support looks good, but when I try to acquire certificate for my domain “блуф.рф” (using acme.sh or gethttpsforfree clients), I receive API error 400: “Name does not end in a public suffix”. Suffix “.рф” is presented here https://publicsuffix.org/list/effective_tld_names.dat. What did I do wrong?

1 Like
9

This is a bug in Boulder: https://github.com/letsencrypt/boulder/issues/2277. We’re working on it! Thanks for your patience.

10

A post was split to a new topic: Certbot reporting Punycode unsupported

11

The fix to that bug was rolled out today; I’m just following up on each thread that mentions it to let the people who encountered it know that they can now go ahead with issuing their certs. So, @Bloof, you can go ahead and get your certificate for блуф.рф now!

2 Likes
12

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.