During Boulder development we encountered a bug in certain versions of the OpenSSL API (our testing indicates this bug was fixed in the 1.0.2 release, although this is not definite) which causes parsing errors in the newer, stricter Golang 1.6 ASN.1 parser. This bug is triggered if a CSR or certific…

Yup, certbot has been fixed since 0.4.1 .

How to check if a csr has this problem? I tried openssl req -text -noout -in my.csr and see: Certificate Request: Data: Version: 0 (0x0) Subject: ... Does the "Version: 0" mean that this CSR exhibits the problem?

OpenSSL will itself compensate for the issue if you are using a buggy version. Instead you want to use openssl asn1parse which will produce an output that looks like this $ openssl asn1parse -inform pem -in test.csr 0:d=0 hl=4 l= 602 cons: SEQUENCE 4:d=1 hl=4 l= 322 cons: SEQUEN…

It looks like neither Debian 7 “Wheezy” (with openssl 1.0.1e-2+deb7u20) nor Debian 8 “Jessie” (openssl 1.0.1k-3+deb8u4) have this problem. Both show: 8:d=2 hl=2 l= 1 prim: INTEGER :00 Good to know. Thank you.

Out of interest how did you generate this CSR? Our investigation showed that CSRs generated using the openssl command line tool were properly formatted but using a language binding (e.g. calling one of the OpenSSL libraries from Python or Ruby) caused the malformed CSRs when the version was not exp…

Hello, sorry my english is not the best and well...so i need to know if this issue is releated to the openSSL Bug [image] SSL_shutdown() failed (SSL: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init) Help H… thanks

It was generated by Neilpang’s acme.sh shell script.

To clarify, using openssl CLI from Debian Wheezy (specifically 1.0.1e-2+deb7u21, in my case) doesn’t produce the explicit x509 version: openssl asn1parse -inform pem -in test.csr | grep INTEGER 8:d=2 hl=2 l= 1 prim: INTEGER :00 Versions of openssl >= 1.0.2 are available from Jessie B…

At the top of this page the cutoff date is specified as November 2017 but the email I received entitled “Let’s Encrypt Malformed CSR Advisory” stated the date was November 17th, 2016.

@roland I tested the above command in docker for many platforms, But it seems that none of them has such issue. Please correct me if I misunderstood. The test code: openssl version openssl genrsa 2048 2>/dev/null > mykey.key openssl req -new -sha256 -key mykey.key -subj "/CN=my.com" | openssl a…

OpenSSL bug information

Issuance Policy

R.Maurer September 17, 2016, 8:25am 8

Hello,

sorry my english is not the best and well...so i need to know if this issue is releated to the openSSL Bug

thanks

Topic		Replies	Views
Bug in ssl4free prevent use of CSR Help	12	2379	April 17, 2020
Certbot "Exiting abnormally" if CSR uses PrivKey with ec parameters encoded (=param_enc explicit) Issuance Tech	12	5176	August 12, 2016
Unable to validate my domain since the last couple of days due to signature algorithm not supported (it was working fine before) Help	8	2909	September 19, 2022
Error parsing certificate request. Extensions in the CSR marked critical can cause this error Help	11	9147	October 22, 2016
Problem with CSR for only one DNS name Client dev	21	8536	September 23, 2016

OpenSSL bug information

Related topics