I have a CSR generated using openssl 1.1.0 for a fairly simple request - two names, as a normal SAN certificate. All the CSR validators claim it is valid, and it seems to contain the right data.
When I attempt to use the ZeroSSL LE client to request a certificate, I get this error (which I think is coming from LE):
Error requesting certificate: Error parsing certificate request: asn1: syntax error: trailing data
I’m generating the CSR using this openssl command:
OpenSSL req -config PDConSec.cfg -new -sha256 -key PDConSec.KEY -out PDConSec.CRT -batch -subj "/CN=www.pdconsec.net"
There’s a corresponding configuration file SiteAlias.cfg:
[req]
req_extensions = req_ext
distinguished_name = dn
[ dn ]
[ req_ext ]
subjectAltName = @alt_names
[alt_names]
DNS.1=www.pdconsec.net
DNS.2=pdconsec.net
It generates a CSR that validates on Comodo, Symantec etc. Is there something special I need to do to openssl to get it to generate “cleaner” output? I would have thought OpenSSL was basically the gold standard for most things SSL/certificate-based.
The only items I found in multiple Google searches were about changes to a Go code file, in which a change was merged to be strict about trailing data even though it’s not a security risk. I can’t see how that would affect this, but … you never know.
Suggestions on a fix are very welcome.
Edit: It seems that if I invert the order of the two names the CSR is accepted (so the last two lines of the CFG file are as follows:
DNS.1=pdconsec.net
DNS.2=www.pdconsec.net
This would seem to be functionally identical other than the order of the SANs. I’m not … horribly upset, but I’d really like to know what is going wrong so I don’t have to debug this in a hurry in six months time.
Edit 2: I don’t understand - some CSRs with a single name work, others with a single name fail. One with four names works with the www name first, but three others with only www.site.net and site.net do not unless I order them with the www name second. I don’t really even know what to look for, now.