CA Creation Removes dnQualifier=<blah> from DN

[Brian Call]

Hi Guys,

I'm trying to create a new root CA with the following DN:

CN=KDM Signer CA,OU=Development,O=PRIMA Cinema,dnQualifier=IpjMnpUKimBnwPx6zNr3FbQn8Kw=

Where dnQualifier is the sha-1 thumbprint of the new CA's public key encoded to base64. When the CA is created the "dnQualifier" field is stripped from the DN (with no error message) resulting in just:

CN=KDM Signer CA,OU=Development,O=PRIMA Cinema

This is not what I want...

Including the dnQualifier field in the DN is a hard requirement for creating D-Cinema spec'd (DCI) certificates and must not be ommitted. Can someone tell me how to keep the dnQualifier included as part of the CA's DN?

Thanks in advance for your help!

Blessings,
Brian

[Tomas Gustavsson]

I used the following:
CN=CAWithDNQualifier,O=foo,DN=IpjMnpUKimBnwPx6zNr3FbQn8Kw\=

It produces a certificate with the following openssl dump:

openssl x509 -in ~/tmp/CAWithDNQualifier.cacert.pem -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 133999823631200639 (0x1dc10212f80b17f)
Signature Algorithm: sha256WithRSAEncryption
Issuer: dnQualifier=IpjMnpUKimBnwPx6zNr3FbQn8Kw=, CN=CAWithDNQualifier, O=foo
Validity
Not Before: Feb 18 12:30:08 2016 GMT
Not After : Feb 18 12:30:08 2017 GMT
Subject: dnQualifier=IpjMnpUKimBnwPx6zNr3FbQn8Kw=, CN=CAWithDNQualifier, O=foo
Subject Public Key Info:

Cheers,
Tomas
Save time and money with an Enterprise support subscription. Please see www.primekey.se for more information.
https://www.primekey.se/technologies/products-overview/
https://www.primekey.se/service-support/support/