0

This is more a conceptual question than it is about a bug/error I'm encountering. I am learning about PKI (public key infrastructure), and attempting to sign my own certifications by walking through one of the SEED labs. When I attempt to sign a CSR using a self-signed CA certification, I get an error message that

The stateOrProvinceName field needed to be the same in the CA certificate (CA) and the request (Some-State).

The full screenshot of my warning looks like the below:

en

I understand that in this case, my Certificate Authority is based in California (CA), and the CSR I'm attempting to sign has a default of Some-State - the two need to match.

Why is this the case? I know that we can bypass this restriction by passing in the -policy policy_anything flag, but I'm wondering why this particular restriction exists in the first place - aren't most root CAs going to be signing certificate requests that are from different states?

I'm having trouble understanding why this is a logical restriction to put into place.

|improve this question
  • This is well explained in stackoverflow.com/questions/6976127/…, which is the first hit I get when googling for this error message – Steffen Ullrich Aug 28 '19 at 4:57
  • 1
    @SteffenUllrich Yes, I also googled and saw that post, thank you. But can you point to where in that link you provided exactly it explains the underlying logic behind why CAs need to be in the same state as the CSR? That seems like an arbitrarily stringent requirement. Debugging the issue is "well explained" I agree, but I'm asking a more conceptual question as I stated in the beginning of the post. – Yu Chen Aug 28 '19 at 5:11
  • 1
    Most (all?) root CAs don't run OpenSSL and neither will they expect the State to be the same as theirs. This seems to be the default set in the OpenSSL configuration file - maybe set simply to show the capability of the tool. – garethTheRed Aug 28 '19 at 5:25
3

This logic is in the configuration (i.e. openssl.cnf) only.
There is likely something like countryName = match in it. It makes sense to have such policy for a company CA where the company is only in a single state (and such policy is often together with organizationName = match). But it does not make sense for a some globally acting CA which issues certificates world wide.
In other words: if such policy should be used depends on the use case and the configuration has to be adjusted to match the expected policy.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.