Only characters, numbers, underscores, minus and whitespace are allowed

[rafall92]

I have a problem. I create new cert, based on CSR file. It's available, and can modify end entity on both RA page and webAdmin page.
I want to check renew of certificate(revoke old, and generate new). Based on documentation, i have to change end entity status from Generated to New. But here is a problem. I have special character in my organization name "&".

When i want to save changes i got error

I have selected option, that allow to use printablestring encoding.

What is wierd, when i try to do the same on RA Page, i don't have any problem

[primetomas]

Why do you have PrintableString encoding in DN selected? That is only for special legacy cases and should never be used for "normal" certificates. PrintableString does not include any localized or special characters. https://en.wikipedia.org/wiki/PrintableString

[rafall92]

After unchecking it, nothing changed. Still cant put & sign in OU field, when editing entity on adminweb

[primetomas]

But with that unchecked you would at least be able to have what you want in the resulting certificate. With PrintableString it would be technically impossible by standards. It is true that the Admin UI is a bit restrictive. If you need to use a Web UI, I always recommend the RA web to register/enroll users.
On a side note, I also generally recommend against using these kinds of characters in certificates. For maximum interoperability, keep it simple...
I verified on my local system that the actual result in a certificate when enrolling with the RA web looks good.

openssl asn1parse -in ~/tmp/support/Tomas.pem -i

  152:d=3  hl=2 l=  21 cons:    SET               
  154:d=4  hl=2 l=  19 cons:     SEQUENCE          
  156:d=5  hl=2 l=   3 prim:      OBJECT            :organizationName
  161:d=5  hl=2 l=  12 prim:      UTF8STRING        :PrimeKey R&D
  175:d=3  hl=2 l=  14 cons:    SET               
  177:d=4  hl=2 l=  12 cons:     SEQUENCE          
  179:d=5  hl=2 l=   3 prim:      OBJECT            :commonName
  184:d=5  hl=2 l=   5 prim:      UTF8STRING        :Tomas

[rafall92]

Yes. I had that option unchecked, but when I tried to solve my problem, I checked it for test. For our purposes, i think it will be impossible to get rid of special signs, so we will use RA web for enroll. Thanks for clarification.