CSR parsing error (mbedtls_x509_csr_parse)

[michaelernst]

Hi guys,

it seems that there is a "problem" with parsing some CSRs using the mbedtls_x509_csr_parse function. If the requests starts with "----BEGIN NEW CERTIFICATE REQUEST----" instead of "----BEGIN CERTIFICATE REQUEST----" (without the new), parsing will fail.

We ran into this problem while parsing CSRs generated by (I guess) Windows machines.

Not that this is a show stopper, but it was definitely not the first thing we were looking for when the errors occurred and only realized it by accident ;).

Best,
Michael

[simonbutcher]

It appears that the Microsoft tool certreq generates the alternative headers that are causing an issue, and that according to the relevant RFC, RFC7468, we are no longer compliant.

Given this is an issue where we're not compliant - this should get some priority.

[ciarmcom]

ARM Internal Ref: IOTSSL-1166