This is more a conceptual question than it is about a bug/error I'm encountering. I am learning about PKI (public key infrastructure), and attempting to sign my own certifications by walking through one of the SEED labs. When I attempt to sign a CSR using a self-signed CA certification, I get an error message that
The stateOrProvinceName field needed to be the same in the CA certificate (CA) and the request (Some-State).
The full screenshot of my warning looks like the below:
I understand that in this case, my Certificate Authority is based in California (CA), and the CSR I'm attempting to sign has a default of Some-State
- the two need to match.
Why is this the case? I know that we can bypass this restriction by passing in the -policy policy_anything
flag, but I'm wondering why this particular restriction exists in the first place - aren't most root CAs going to be signing certificate requests that are from different states?
I'm having trouble understanding why this is a logical restriction to put into place.