sign_csr.py fails on debian stretch with OpenSSL 1.1.0f 25 May 2017

[moosbaue]

Hi

Thank you for this very useful script.
I recently upgraded to debian stretch from jessie. With my now installed openssl version (1.1.0.f) the script fails. It still works with OpenSSL 1.0.1t on a jessie box

It fails in
line 70: common_name = re.search("Subject:.*? CN=([^\s,;/]+)", out)
because format of CN changed
from CN=([^\s,;/]+)
to CN = ([^\s,;/]+)
the = sign is surrounded by blanks

I do not know if I am the only one with this issue, but changing the regex works for me

Thank you
Josef

[moosbaue]

I am not very experienced in regex but
common_name = re.search("Subject:.*? CN ?= ?([^\s,;/]+)", out)
handel's both cases

[diafygi]

Are you using an outdated version of sign_csr.py? The current version is CN *= *([^\s,;/]+)

https://github.com/diafygi/acme-nosudo/blob/master/sign_csr.py#L74