[Freeipa-devel] OpenSSL CA complains that CSR from --external-ca missing mandatory Country field.

[Jeff B]

I'm not sure if this is a user error or a bug.  I didn't see a way to
tell OpenSSL to not require that Country be in the CSR.

Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
organizationName      :PRINTABLE:'MYREALM.COM'
commonName            :PRINTABLE:'Certificate Authority'
The mandatory countryName field was missing

I didn't see anything in Trac regarding this.