Help required for CSR validation

[Wilankar, Trupti]

Hi Nikos,
Thanks for the patch. Although the NULL fields are now visible in the CSR (as verified in OpenSSL), the CSR is still not acceptable by the CAs like Verisign, Thawte,  GeoTrust etc. Verisign continues to give the error 'CSR encoding error. Submit a valid CSR.'
Any thoughts as to what could be causing this issue. We have tried changing various parameters of the CSR like version, signature algorithm etc.. but nothing works.

Regards,
Trupti

-----Original Message-----
From: Nikos Mavrogiannopoulos [mailto:n.mavrogiannopoulos at gmail.com] On Behalf Of Nikos Mavrogiannopoulos
Sent: Wednesday, November 18, 2009 11:45 PM
To: Wilankar, Trupti
Cc: gnutls-devel at gnu.org; Konjarla, Pavan; Amburle, Rohan
Subject: Re: Help required for CSR validation

Wilankar, Trupti wrote:
> Hello,
> 
> I am from the iTP WebServer development team. The webserver runs on the HP NonStop Kernel. We are enhancing the webserver to comply with the TLS 1.1 standards and are using GnuTLS to extend this support.
> We are facing problems with regards to validation of the CSR generated using the GnuTLS APIs.
>  Though the CSR seems valid (as verified in OpenSSL and other online CSR decoders), CAs like Verisign, Thawte etc give an error while parsing the CSR.
> 
> We generated CSRs with same DN attributes with GnuTLS and OpenSSL.  After ASN1 parsing both the CSRs in OpenSSL, we found that the CSR generated by GnuTLS misses NULL paddings separating the CertificationRequestInfo, signatureAlgorithm and Signature.
[...]
> Is it possible that the CAs are unable to generate a valid certificate due to these NULL paddings or is there another reason why these CAs fail to parse the CSR.

Hi,
 Thanks for bringing that up to me. Probably it might be some error in the parsing library of the CA. I attach you a quick fix and if it works for you I will add an option to encode using this format in certtool.

regards,
Nikos