A customer reported problems with cyrillic characters in the Common Name portion of the Distinguished Name when enroling in the RA web on Appliance. The CN (when Bastian tested) was "Га́рри Ки́мович Каспа́ров" (Garry Kasparov).

EJBCA has no problems with cyrillic characters but the proxy of the appliance does not allow these characters in the HTTP header. Since EJBCA specifies the filename of the PEM file as the CN of the certificate, any cyrillic characters in the CN will end up in the Content-Disposition header, causing an error on the appliance when returning the HTTP response.

Since the customer has reported the use of the (old) public web + CA web (admin web) as a workaround, I have marked this issue as Minor, but it should probably be fixed in the next appliance release since we are moving away from the public web anyway.

A quick and dirty (but not necessarily the best) way of fixing this from EJBCA is to base64 encode the filename or substitute any non-ASCII characters.