It seems like OpenSSL is broken when trying to read back subjectAltName/otherName/UTF8 values that were written by itself:
The relevant openssl.cnf configuration (using an official but random OID):
[alt_names] DNS.1 = www.foo.com DNS.2 = www.bar.org IP.1 = 192.168.1.1 IP.2 = 192.168.69.144 email = email@me otherName = 188.8.131.52.4.1.1;UTF8:some other identifier
A sample from the dump of a CSR generated from this config:
TLS Web Server Authentication X509v3 Subject Alternative Name: DNS:www.foo.com, DNS:www.bar.org, IP Address:192.168.1.1, IP Address:192.168.69.144, email:email@me, othername:<unsupported> Signature Algorithm: sha1WithRSAEncryption 6f:4a:1d:8f:43:7e:4d:d1:0c:7e:05:9d:1f:f0:98:b1:69:cf:
Can someone indicate whether I'm doing something wrong? This is driving me nuts.