Generate CSR for an other certificate provider

JoshData · October 16, 2017, 10:06pm

openssl has gotten stricter about the inputs it accepts. The -subj option at

mail-in-a-box/mailinabox/blob/master/management/ssl_certificates.py#L559


			return ("The certificate does not correspond to the private key at %s." % ssl_private_key, None)

		# We could also use the openssl command line tool to get the modulus
		# listed in each file. The output of each command below looks like "Modulus=XXXXX".
		# $ openssl rsa -inform PEM -noout -modulus -in ssl_private_key
		# $ openssl x509 -in ssl_certificate -noout -modulus

	# Third, check if the certificate is self-signed. Return a special flag string.
	if cert.issuer == cert.subject:
		return ("SELF-SIGNED", None)

	# When selecting which certificate to use for non-primary domains, we check if the primary
	# certificate or a www-parent-domain certificate is good for the domain. There's no need
	# to run extra checks beyond this point.
	if just_check_domain:
		return ("OK", None)

	# Check that the certificate hasn't expired. The datetimes returned by the
	# certificate are 'naive' and in UTC. We need to get the current time in UTC.
	import datetime
	now = datetime.datetime.utcnow()

probably needs to be revised to be "/C=%s/CN=%s" instead of "/C=%s/ST=/L=/O=/CN=%s". If someone could submit this change in a pull request that’d be appreciated, including an entry in the CHANGELOG and a reference to the commit below.

We hit a related issue here: