[openssl-users] sign sub CA issue

[Ben Humpert]

Tell the person who created the CSR that the value of the
stateOrProvinceName field has to be HK. If that is not possible
because the subCA is in a different country you can change your
openssl.cnf to allow different values in that field so instead of
stateOrProvinceName = match you have to use at least
stateOrProvinceName = supplied

2015-12-11 15:18 GMT+01:00 Mohammad Jebran <imjebran at gmail.com>:
> Please can I have some advise on this query.
>
> Regards,
> Jebran.
>
> On Tue, Dec 8, 2015 at 11:18 AM, Mohammad Jebran <imjebran at gmail.com> wrote:
>>
>> I have to sign a sub-CA through my current root CA using openSSLeverything
>> I have configured as per instructions but still getting an error that
>> "stateorProvanceName field needed to be the same" As mentioned below.
>>
>>
>>
>>
>>
>> root at machine:~/ImportantCACerts/intermediate# openssl ca
>> -configopenssl.cnf -extensions v3_intermediate_ca -days 3650 -notext -md
>> sha256 -in csr/subca2.csr -out certs/subca2.crt
>>
>> Using configuration from openssl.cnf
>>
>> Check that the request matches the signature
>>
>> Signature ok
>>
>> The stateOrProvinceName field needed to be the same in the
>>
>> CA certificate (HK) and the request (HK)
>>
>>
>>
>>
>>
>> Thanks & Regards,
>> Jebran.
>
>
>
> _______________________________________________
> openssl-users mailing list
> To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
>