Re: ASN.1 parse asn1 parse error with openssl ca module, but no issues reported by x509 module or asn1parse module

Thank you much, that was the clue I needed! ^^

On Friday, February 27, 2026 at 2:42:00 AM UTC-8 Viktor Dukhovni wrote:

> On Thu, Feb 26, 2026 at 11:55:49PM -0800, Andy Wood wrote:
>
> > I've tried running the command line my automation is using by hand and I 
> > can reproduce the issue reliably, but when I run openssl x509 -text,
>
> The `openssl x509` command prints certificates, not CSRs.
> To print a CSR you need to use `openssl req`.
>
> > I've uploaded a terminal log of the described behavior, plus one of the 
> > culprit CSRs and my openssl ca config to my public webserver for 
> reference:
> > https://pdxlents.online/openssl_misbehavior.txt
> > https://pdxlents.online/openssl.cnf
> > https://pdxlents.online/rhyolite.houseof.rocks.csr.pem
>
> The last of these holds a certificate, not a CSR.
>
> $ curl -sLo - 'https://pdxlents.online/openssl_misbehavior.txt'
> basalt:~# /usr/bin/openssl ca -config /root/ca/intermediate/openssl.cnf \
> -passin file:/tmp/ansible.3s7lximp -extensions server_cert -days 375 \
> -notext -md sha256 -in 
> /usr/local/share/csr-signing/csr/rhyolite.houseof.rocks.csr.pem \
> -out /usr/local/share/csr-signing/cert/rhyolite.houseof.rocks.cert.pem
>
> Well, that '-in' file does not hold a CSR.
>
> basalt:~# openssl x509 -in 
> /usr/local/share/csr-signing/csr/rhyolite.houseof.rocks.csr.pem -inform pem 
> -text -noout
>
> And there you are showing it holds a certificate...
>
> Certificate:
> Data:
> Version: 3 (0x2)
> ...
>
> -- 
> Viktor. 🇺🇦 Слава Україні!
>

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/d846c020-64ec-4606-bdff-a5d23c767957n%40openssl.org.