{"action":"created","issue":{"url":"https://api.github.com/repos/pyca/pyopenssl/issues/628","repository_url":"https://api.github.com/repos/pyca/pyopenssl","labels_url":"https://api.github.com/repos/pyca/pyopenssl/issues/628/labels{/name}","comments_url":"https://api.github.com/repos/pyca/pyopenssl/issues/628/comments","events_url":"https://api.github.com/repos/pyca/pyopenssl/issues/628/events","html_url":"https://github.com/pyca/pyopenssl/issues/628","id":229669812,"number":628,"title":"pyopenssl generates CSR that gives \"Error: Object has zero length.\" in ASN.1 dump","user":{"login":"gdubicki","id":566632,"avatar_url":"https://avatars1.githubusercontent.com/u/566632?v=3","gravatar_id":"","url":"https://api.github.com/users/gdubicki","html_url":"https://github.com/gdubicki","followers_url":"https://api.github.com/users/gdubicki/followers","following_url":"https://api.github.com/users/gdubicki/following{/other_user}","gists_url":"https://api.github.com/users/gdubicki/gists{/gist_id}","starred_url":"https://api.github.com/users/gdubicki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gdubicki/subscriptions","organizations_url":"https://api.github.com/users/gdubicki/orgs","repos_url":"https://api.github.com/users/gdubicki/repos","events_url":"https://api.github.com/users/gdubicki/events{/privacy}","received_events_url":"https://api.github.com/users/gdubicki/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-05-18T13:24:16Z","updated_at":"2017-06-10T12:27:25Z","closed_at":"2017-06-10T12:27:25Z","body":"I am using PyOpenSSL 17.0.0 and the following code to generate CSR:\r\n\r\n```\r\n        req = crypto.X509Req()\r\n        subj = req.get_subject()\r\n        for (key, value) in name_array.items():\r\n            setattr(subj, key, value)\r\n\r\n        req.set_pubkey(pkey)\r\n        req.sign(pkey, digest)\r\n```\r\n\r\n...with correct `pkey` and `name_array` values. This gives me CSR with when decoded with ASN.1 dump tool such as https://redkestrel.co.uk/products/decoder/ gives the following error:\r\n\r\n```\r\n(...)\r\n 110   13:       SEQUENCE {\r\n 112    9:         OBJECT IDENTIFIER rsaEncryption (1 2 840 113549 1 1 1)\r\n 123    0:         NULL\r\n         :         }\r\n 125  527:       BIT STRING\r\n         :         30 82 02 0A 02 82 02 01 00 A5 82 15 23 28 5F 1A\r\n         :         5E 69 D4 14 9F 60 B3 34 60 B6 76 3B 58 D0 41 49\r\n         :         45 2A F2 5D C5 5D 8B 50 BB D6 1F 50 CC EC 47 D6\r\n         :         17 B7 0B 9E F9 62 F0 3A 03 98 F0 C5 91 4E A2 AD\r\n         :         72 A0 52 C1 2F 70 67 12 F8 EF 9A 2A 8A 41 8E 99\r\n         :         C1 E8 8F 56 4D 0D 6B ED E8 F9 44 04 33 7F 78 F3\r\n         :         61 E4 F7 F9 24 68 97 42 60 02 F6 99 70 C3 8A 41\r\n         :         30 16 45 29 44 1F B7 87 34 8A 4C F9 BE 6B B4 31\r\n         :                 [ Another 398 bytes skipped ]\r\n         :       }\r\n 656    0:     [0]\r\n         :       Error: Object has zero length.\r\n         :     }\r\n(...)\r\n``` \r\n\r\nThis is resolved if I add the following line to CSR creation code:\r\n\r\n```\r\n        req.add_extensions([])\r\n```\r\n\r\n..but I feel that I should not have to do it, it should be initially set to a reasonable default."},"comment":{"url":"https://api.github.com/repos/pyca/pyopenssl/issues/comments/307562221","html_url":"https://github.com/pyca/pyopenssl/issues/628#issuecomment-307562221","issue_url":"https://api.github.com/repos/pyca/pyopenssl/issues/628","id":307562221,"user":{"login":"gdubicki","id":566632,"avatar_url":"https://avatars1.githubusercontent.com/u/566632?v=3","gravatar_id":"","url":"https://api.github.com/users/gdubicki","html_url":"https://github.com/gdubicki","followers_url":"https://api.github.com/users/gdubicki/followers","following_url":"https://api.github.com/users/gdubicki/following{/other_user}","gists_url":"https://api.github.com/users/gdubicki/gists{/gist_id}","starred_url":"https://api.github.com/users/gdubicki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gdubicki/subscriptions","organizations_url":"https://api.github.com/users/gdubicki/orgs","repos_url":"https://api.github.com/users/gdubicki/repos","events_url":"https://api.github.com/users/gdubicki/events{/privacy}","received_events_url":"https://api.github.com/users/gdubicki/received_events","type":"User","site_admin":false},"created_at":"2017-06-10T12:27:25Z","updated_at":"2017-06-10T12:27:25Z","body":"I have tested how openssl itselfs behaves when creating CSR and actually it does the same thing.\r\n\r\nTested on OS X 10.12.5 (16F73) using:\r\n* system default OpenSSL 0.9.8zh 14 Jan 2016\r\n* homebrew OpenSSL 1.0.2l  25 May 2017\r\n\r\nClosing then."}}
{"actor":{"display_login":"gdubicki"}}