Re: ASN.1 parse asn1 parse error with openssl ca module, but no issues reported by x509 module or asn1parse module

On Thu, Feb 26, 2026 at 11:55:49PM -0800, Andy Wood wrote:

> I've tried running the command line my automation is using by hand and I 
> can reproduce the issue reliably, but when I run openssl x509 -text,

The `openssl x509` command prints certificates, not CSRs.
To print a CSR you need to use `openssl req`.

> I've uploaded a terminal log of the described behavior, plus one of the 
> culprit CSRs and my openssl ca config to my public webserver for reference:
> https://pdxlents.online/openssl_misbehavior.txt
> https://pdxlents.online/openssl.cnf
> https://pdxlents.online/rhyolite.houseof.rocks.csr.pem

The last of these holds a certificate, not a CSR.

    $ curl -sLo - 'https://pdxlents.online/openssl_misbehavior.txt'
    basalt:~# /usr/bin/openssl ca -config /root/ca/intermediate/openssl.cnf \
        -passin file:/tmp/ansible.3s7lximp -extensions server_cert -days 375 \
        -notext -md sha256 -in /usr/local/share/csr-signing/csr/rhyolite.houseof.rocks.csr.pem \
        -out /usr/local/share/csr-signing/cert/rhyolite.houseof.rocks.cert.pem

Well, that '-in' file does not hold a CSR.

    basalt:~# openssl x509 -in /usr/local/share/csr-signing/csr/rhyolite.houseof.rocks.csr.pem -inform pem -text -noout

And there you are showing it holds a certificate...

    Certificate:
        Data:
            Version: 3 (0x2)
            ...

-- 
    Viktor.  🇺🇦 Слава Україні!

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/aaF06_hQnw2ZorL4%40chardros.imrryr.org.