Workstation: Windows Pro 8.1 OpenSSL version: 1.0.2d-x64

I have a CSR generated via an Exchange 2010 management console. I'd like to self sign it with openssl but I am having issues parsing the CSR. I'm trying to verify the CSR with the following command

.\openssl req -config .\openssl.cnf -in c:\temp\Exchange2010.csr -noout -text

But I can't seem to figure out why I get the response

unable to load X509 request

13756:error:0906D06C:PEM routines:PEM_read_bio:no start line:.\crypto\pem\pem_lib.c:701:Expecting: CERTIFICATE REQUEST

From the reading I've done that output indicates openssl is trying to parse a PEM format. I've also read that I can instruct it to parse it in DER format. The command I use is:

.\openssl req -config .\openssl.cnf -inform DER -in c:\temp\Exchange2010.csr -noout -text

But the output from that command is:

unable to load X509 request

16928:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:.\crypto\asn1\tasn_dec.c:1180:

16928:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:.\crypto\asn1\tasn_dec.c:365:Type=X509_REQ

I thought the CSR might be damaged somehow so I went online and found a CSR validation tool. It parses the CSR just fine and reports back all the expected field data.

What am I missing here?

  • How do you want to self-sign the request without private key? It appears that you are trying to do something wrong.
    – Crypt32
    Oct 17, 2015 at 6:34
  • Sorry CryptoGuy, I misspoke. I have a CA key and cert I created. I want to sign the request with that. Oct 17, 2015 at 17:37

1 Answer 1


The format of the CSR generated by EMC is binary. Use

certutil.exe -encode binary.csr ascii.csr
  • I feel like this got me closer but still no luck. If i -dump the contents of the CSR with certuil.exe all expected fields are displayed. However after spinning it through -encode I still get the errors described in my original post. Maybe I did something wrong? Oct 17, 2015 at 17:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .