問題如下：

Check that the request matches the signature
Signature ok
The countryName field is different between
CA certificate (CN) and the request (CN)

可以看出，CA和REQ的DN內容是一致的，依舊報錯。其實是編碼的問題。

使用以下指令看編碼格式：

openssl asn1parse -in /etc/pki/CA/cacert.pem

openssl asn1parse -in server01.csr

請求文件的countryName是UTF8STRING，CA證書是PRINTABLESTRING。

在openssl.cnf配置文件中有個字符編碼設置string_mask=utf8only。雖然要求openssl ca證書字段都為utf8，但實際上DN的countryName仍然為PRINTABLESTRING。

# This sets a mask for permitted string types. There are several options. # default: PrintableString, T61String, BMPString. # pkix : PrintableString, BMPString (PKIX recommendation before 2004) # utf8only: only UTF8Strings (PKIX recommendation after 2004). # nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings). # MASK:XXXX a literal mask value. # WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings. string_mask = utf8only

?查閱了很多資料，都不太好處理或者無效。提供兩個簡單方法，1、修改簽發證書的匹配策略來解決該問題。

[ policy_match ] countryName = supplied stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional

即，將countryName原來的match修改supplied，繞過匹配。

2、修改csr文件DN域的格式為V_ASN1_PRINTABLESTRING

X509_NAME_add_entry_by_txt(x509_name, "CN", V_ASN1_UTF8STRING, (const unsigned char*)pbCN, -1, -1, 0);X509_NAME_add_entry_by_txt(x509_name, "OU", V_ASN1_UTF8STRING, (const unsigned char*)pbOU, -1, -1, 0);X509_NAME_add_entry_by_txt(x509_name, "O", V_ASN1_UTF8STRING, (const unsigned char*)pbO, -1, -1, 0);X509_NAME_add_entry_by_txt(x509_name, "L", V_ASN1_UTF8STRING, (const unsigned char*)pbL, -1, -1, 0);X509_NAME_add_entry_by_txt(x509_name, "ST", V_ASN1_UTF8STRING, (const unsigned char*)pbST, -1, -1, 0);X509_NAME_add_entry_by_txt(x509_name, "C", V_ASN1_PRINTABLESTRING, (const unsigned char*)pbC, -1, -1, 0);

總結

以上是生活随笔為你收集整理的OpenSSL签发证书时编码UTF8STRING PRINTABLESTRING不匹配的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。