47

On running:

openssl ca -in ${ALIAS}.csr -out user-cert.pem -keyfile cacert-private.pem -cert cacert.pem -passin pass:$PASSWD -config ${CONFIG}

I get:

The stateOrProvinceName field needed to be the same in the CA certificate (Gloucestershire) and the request (Gloucestershire)

I've read the error a few times and I'm fairly sure the field is the same value in each case. I have found references to similar problems being caused by different encodings but I don't know how I should be specifying that and where.

This is the ${ALIAS}.csr:

-----BEGIN NEW CERTIFICATE REQUEST-----
MIICxzCCAa8CAQAwgYExCzAJBgNVBAYTAkdCMRgwFgYDVQQIEw9HbG91Y2VzdGVyc2hpcmUxEzAR
BgNVBAcTCkNoZWx0ZW5oYW0xHzAdBgNVBAoTFldhbnNkeWtlIEhvdXNlIExpbWl0ZWQxDjAMBgNV
BAsTBUZpemlvMRIwEAYDVQQDEwlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQDWvivt1JHiuaNeadOQJtxynQ4sSAR/peWgKd8g9UQgNM+H9QW4NlRE81+g63BdRqZT5YMm
J4K3upovQNlDRklevslgEYoTdQM4yBKV676Q4XDbM7Vk+rt04sqL5IgdsAUXODfMJvu81t3tOjFc
OGO7S+B+LEJ1+8qshLbuK2gBigfgcZtlbNgW6fCGik8ZsrKWl8W+NFbw1seS01INAipwCBasxaaj
/lINwWQVbQIG09+vEdwuHmmq5VIKlJqFcYNUTFBVojoJLfzyStZR2PfFUxp7R+t2YmVj6a48B7NA
lODnIlQDkAprECNMpCZoSP1QjrZgW1BgaVbT5OaWlVsPAgMBAAGgADANBgkqhkiG9w0BAQUFAAOC
AQEAvalFyJOgzmd1jcFlS5YoqiNgX1bm9nZ0/cFgj6cGL7R0Gqc9wu5QPakWRxa9c2UcI0m7p1lp
cygDvQTY23LEBhVcruymIGQG5DhDpXHeaBCbV3OWO6xowAjh+riQjvTNeVSXtP3jUNs5DaId0z+A
GXeb7dR96jhyj+soNYENoQseQLqLdAW4p0jdK1BraMJTc0ber0FBx1nOUXOEoTIJL9kL9cUWaCp3
7uYkonIPtVCCfS8KcgXxUsNMC41q/SkKDVB23PeCjnWgcyXxnSpx8n+AK7fwMgh+4TcZ5usmVujR
MNqk84hZpw8h1FIcmqRaWtaPWyv3EX8JH5LTnDe3eQ==
-----END NEW CERTIFICATE REQUEST-----

And cacert.pem:

-----BEGIN CERTIFICATE-----
MIIDQDCCAqmgAwIBAgIJAPj9mvMDl1K/MA0GCSqGSIb3DQEBBQUAMIG4MQswCQYD
VQQGEwJHQjEYMBYGA1UECAwPR2xvdWNlc3RlcnNoaXJlMRMwEQYDVQQHDApDaGVs
dGVuaGFtMR8wHQYDVQQKDBZXYW5zZHlrZSBIb3VzZSBMaW1pdGVkMQ4wDAYDVQQL
DAVGaXppbzESMBAGA1UEAwwJbG9jYWxob3N0MTUwMwYJKoZIhvcNAQkBFiZyaWNo
YXJkLm1pZHdpbnRlckB3YW5zZHlrZS1ob3VzZS5jby51azAeFw0xMTA4MDcyMTU4
NDBaFw0yMTA4MDQyMTU4NDBaMIG4MQswCQYDVQQGEwJHQjEYMBYGA1UECAwPR2xv
dWNlc3RlcnNoaXJlMRMwEQYDVQQHDApDaGVsdGVuaGFtMR8wHQYDVQQKDBZXYW5z
ZHlrZSBIb3VzZSBMaW1pdGVkMQ4wDAYDVQQLDAVGaXppbzESMBAGA1UEAwwJbG9j
YWxob3N0MTUwMwYJKoZIhvcNAQkBFiZyaWNoYXJkLm1pZHdpbnRlckB3YW5zZHlr
ZS1ob3VzZS5jby51azCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA03Y4hYdd
at3e3AB98s+E5wlxrvRL8RhJtRac0Jt0gXQy12ZYziFm3gryx0IG02srXluM+V3/
BPRRCLsnEnltfoi/fE0wM9MT0V1Ao9EXQ5t1E2rOzdoXUUdvovd6qvwG2L/DHCdL
kKjhokVR9TkFW/AWctBdWkb9qfFFTpDY4i0CAwEAAaNQME4wHQYDVR0OBBYEFHbG
d3+Lzax90slk65y1BYDgZ897MB8GA1UdIwQYMBaAFHbGd3+Lzax90slk65y1BYDg
Z897MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEArZ2yfTGJK3R+jRwP
FjaonDy1NVOt9tgjHfyh9YNQfyFSC7R987wFPcyydEqh8xg/Lb3WGwseDuzCBusw
jmVIqiUYBClHzkF3jG1766ltdlVVTOavVQgQMRBGMvpHVxcMH2RUNUyWH0XW+DH2
/uuRRpu4vX5sfEW75uEfORB9Mrg=
-----END CERTIFICATE-----

Any ideas? Thanks in advance.

3
  • Can you post the relevant PEM files (except the key file, of course)?
    – emboss
    Aug 8, 2011 at 9:56
  • Thanks. Hopefully I've added the correct ones, if there's a key file there they're only test ones.
    – rich
    Aug 8, 2011 at 18:00
  • Yes, the command is from a shell script and the files are created by tools in the JDK.
    – rich
    Aug 8, 2011 at 19:10

6 Answers 6

47

You can also set the attributes as optional:

# For the CA policy

[policy_match]
countryName= optional
stateOrProvinceName= optional
organizationName= optional
organizationalUnitName= optional
commonName= supplied
emailAddress= optional
3
  • 20
    I believe /usr/ssl/openssl.cnf contains a policy called policy_anything that contains the above setup. You can use it by utilizing the policy argument as follows: openssl ca -policy policy_anything -days 365 -out /root/ca/certs/out.pem -in certreq.csr
    – brandeded
    May 29, 2013 at 20:53
  • 1
    policy_anything did the trick for me. Definitely a more convenient approach than fiddling with the CSR bits, or the OpenSSL configs.
    – arcain
    Jun 18, 2014 at 20:42
  • if you want to use the policy_anything by default you can update your config to policy = policy_anything, and then use -policy policy_match if you ever need to (or you can create your own policy as the default)
    – STW
    Mar 26, 2015 at 16:29
25

I have also run into this problem. Thanks to the replies above (mainly Francois), I discovered the source of the problem.

openssl is encoding using UTF8STRING and keytool (Java 6) is encoding with PRINTABLESTRING.

Worked around it by changing the openssl configuration so it matches keytool. In /usr/ssl/openssl.cnf change the "string_mask" setting to "pkix".

0
18

The previous posters already answered the question, but to make it easier, here is an example how to specify the encoding. Use the string_mask:

[ req ]
default_bits            = 2048
default_md              = rsa
prompt                  = no
string_mask             = utf8only  # <--------------
distinguished_name      = req_distinguished_name

[ req_distinguished_name ]
countryName             = GB
stateOrProvinceName     = Gloucestershire
localityName            = Cheltenham
organizationName        = Wansdyke House Limited
organizationalUnitName  = Fizio
commonName              = localhost
9

As shown by :

openssl asn1parse -in req.csr  

the request DN strings are encoded as PRINTABLESTRING.

openssl asn1parse -in cacert.pem 

shows the CA DN strings are encoded as UTF8STRING.

For a quick'n dirty hack, I suggest you change the encoding of strings in your request by replacing the encoding type for PRINTABLESTRING (0x13) by the type for UTF8STRING (0x0c), using your favorite hex editor.
You will have to convert your request in DER before poking it.
The offset of bytes to change can be found with :

openssl asn1parse -in csr |grep PRINTABLESTRING |awk -F":" '{print $1}' 

Then try to sign again.

2
  • Were you able to perform any awk gymnastics to get this done?
    – brandeded
    Nov 19, 2013 at 21:06
  • You can't change the bytes in the CSR, as it's signed.
    – miken32
    Jun 2, 2016 at 23:44
8

I just ran into this problem. The root cause is a mismatch between the values of string_mask in the client's and the CA's openssl.cnf. The easy fix is to modify the client's value to match what the CA expects, then regenerate the CSR. The hard fix is to edit the CA's value and start a fresh CA.

8

Promoting mbrownnyc's comment to an answer, as it was useful to me and deserves more attention.

I believe /usr/ssl/openssl.cnf contains a policy called policy_anything that contains the above setup. You can use it by utilizing the policy argument as follows:

openssl ca -policy policy_anything -days 365 -out /root/ca/certs/out.pem -in certreq.csr 
4
  • Are you sure that it deserves to be a separate answer? Feb 10, 2016 at 15:24
  • 1
    I think so. It presents a simpler way of solving the problem.
    – legoscia
    Feb 10, 2016 at 15:26
  • "unable to find 'section' for policy_anything" ... this doesn't solve anything :(
    – user568021
    Jun 5, 2019 at 9:09
  • Sometimes it is called policy_loose instead
    – Chris H.
    Oct 16, 2020 at 18:52

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.