[Bug]: `x509_v2` misses support for `otherName`

What happened?

Currently, the x509_v2 modules do not know how to deal with otherName definitions, e.g. in a subjectAltNames extension. This includes rendering of said values in read_certificate - the extension object is just str()'d.

This was intentionally left out during the initial implementation. I'd still like to treat this as a bug since it's a breaking change versus the previous modules and some basic support should go a long way:

• Understand othername:1.2.3.4;UTF8:foobar definitions from OpenSSL. Limit it to UTF8 ASN1 types.
• For more complex use cases, allow to specify raw DER values as hex/base64 that are passed through.
• When rendering, at least try to decode the value as a UTF8STRING.

Type of salt install

Official deb

Major version

3006.x

What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)

ubuntu-24.04

salt --versions-report output

Current HEAD of 3006.x

Start by locating the x509_v2 modules and the read_certificate rendering path, then inspect how subjectAltNames values are currently parsed and displayed. Done means supporting OpenSSL otherName UTF8 definitions, accepting raw DER values as hex or base64, and attempting UTF8STRING decoding when rendering.