Workstation: Windows Pro 8.1 OpenSSL version: 1.0.2d-x64

I have a CSR generated via an Exchange 2010 management console. I'd like to self sign it with openssl but I am having issues parsing the CSR. I'm trying to verify the CSR with the following command

.\openssl req -config .\openssl.cnf -in c:\temp\Exchange2010.csr -noout -text

But I can't seem to figure out why I get the response

unable to load X509 request

13756:error:0906D06C:PEM routines:PEM_read_bio:no start line:.\crypto\pem\pem_lib.c:701:Expecting: CERTIFICATE REQUEST

From the reading I've done that output indicates openssl is trying to parse a PEM format. I've also read that I can instruct it to parse it in DER format. The command I use is:

.\openssl req -config .\openssl.cnf -inform DER -in c:\temp\Exchange2010.csr -noout -text

But the output from that command is:

unable to load X509 request

16928:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:.\crypto\asn1\tasn_dec.c:1180:

16928:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:.\crypto\asn1\tasn_dec.c:365:Type=X509_REQ

I thought the CSR might be damaged somehow so I went online and found a CSR validation tool. It parses the CSR just fine and reports back all the expected field data.

What am I missing here?

  • How do you want to self-sign the request without private key? It appears that you are trying to do something wrong. – Crypt32 Oct 17 '15 at 6:34
  • Sorry CryptoGuy, I misspoke. I have a CA key and cert I created. I want to sign the request with that. – Donovan Oct 17 '15 at 17:37

The format of the CSR generated by EMC is binary. Use

certutil.exe -encode binary.csr ascii.csr
  • I feel like this got me closer but still no luck. If i -dump the contents of the CSR with certuil.exe all expected fields are displayed. However after spinning it through -encode I still get the errors described in my original post. Maybe I did something wrong? – Donovan Oct 17 '15 at 17:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.