@protypangel: You must never upload or expose a private key. Please immediately revoke any certificates that are using the key you posted, destroy it, and generate a new private key.
DER, the binary encoding format for ASN.1 data, is a tag-length-value encoding: each field begins with a tag (telling the decoder what field it is), then a length (telling the decoder how many bytes to consume), and then the data itself.
This error comes from here in the Go standard library's asn.1 parser. It means that the CSR contains a field which claims to be a certain length (e.g. 100 bytes), but in fact the CSR runs out of bytes to parse first (e.g. it had only 99 more bytes worth of data before the end of the string).
What is the exact command that you used to generate this CSR?
Hmm, I thought I read somewhere zlint also was able to check CSRs, but I can't find it a second time. Maybe I'm mistaken with some other linter, silly me.
It's just pock so you don't need to worry about the private key.
How do you will generate the secure part of the api to proof that everything is okey if you don't have the private key ?
The -reqexts option is specifying a section of a generated OpenSSL config file that is listing all of the SANs for the certificate. It looks like getssl will ALWAYS put in SANs in the CSR, even if there is only one domain. I know that RFC 8555 says putting the domain name in the subject is sufficient, but maybe you could try putting the domain name in the SAN list as well?
Osiris already explained that the SAN is a certificate extension, not part of the subject. I do not know how you put certificate extensions in your CSR using the API you are using; I'm assuming it's via one of the arguments you pass in as a null. You're going to have to figure that out, but I am 99% sure your API has that ability, as this is extremely common thing to do.
My reading of the getssl code is that the default openssl configuration file is copied to a temporary location (defined by the variable tmp_conf) and the following config file fragment is appended to the end of it:
The default openssl configuration file is determined by running openssl version -d and looking for openssl.cnf in the OPENSSLDIR value returned by that command. The -reqexts SAN option means "Add the stuff specified in the SAN section of the config file as an extension to the CSR". The exact details of that format is specified in the openssl man page x509v3_config.
are you okey ?
I ask question to upgrade my skill not to satisfy you ...
I need to understand how to generate a correct csr, is that hard to you to understand / write the command when you have skill that i havent ?
This generates a CSR which is perfectly accepted by the Let's Encrypt API when I use it as input for Certbot using the --csr option. The payload send to the ACME server is exactly the same as the PEM CSR file minus of course the base64 -> base64url conversion, the linebreaks and the two header lines which are present in the PEM file, but of course not in the payload..
Thus, generating the required CSR should not be that hard. An absolute bare minimum is only that's required.
