creating cert with openssl throwing "maxsize" error when country code is 2 letters

Viewed 1404

Running

openssl req -config ./mokconfig.cnf \
        -new -x509 -newkey rsa:2048 \
        -nodes -days 36500 -outform DER \
        -keyout "MOK.priv" \
        -out "MOK.der"

With mokconfig.cnf containing

# This definition stops the following lines failing if HOME isn't
# defined.
HOME                    = .
[ req ]
distinguished_name      = req_distinguished_name
x509_extensions         = v3
string_mask             = utf8only
prompt                  = no

[ req_distinguished_name ]
countryName             = <US>
stateOrProvinceName     = <Idaho>
localityName            = <Boise>
0.organizationName      = <Development>
commonName              = Secure Boot Signing Key
emailAddress            = <*MYEMAIL*>

[ v3 ]
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer
basicConstraints        = critical,CA:FALSE
extendedKeyUsage        = codeSigning,1.3.6.1.4.1.311.10.3.6
nsComment               = "OpenSSL Generated Certificate"

Which is returning this error

Generating a RSA private key
......................................................................................................................................................................+++++
..........................+++++
writing new private key to 'MOK.priv'
-----
problems making Certificate Request
140510219141568:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:../crypto/asn1/a_mbstr.c:107:maxsize=2

Based on what I can gather and what I've researched this is referring to the country code having a maxsize=2. As you can see in the config file, the country code is "US" which is 2 characters.

Ubuntu 18.04.3

I must be missing something but I can't see it and need a helping hand

Thanks is advance

2 Answers

Reason is that it expects only two characters for country code. When you add more than 2 characters to country code, you will get the max size error.

Related