title: OpenSSL Config error when generating self-signed certificate string too long
body: <p>With the following OpenSSL Config</p>
  
  <pre><code>[ req ]
  default_bits        = 2048
  default_md          = sha256
  default_keyfile     = drone-ci-web.company.com.key.pem
  distinguished_name  = subject
  req_extensions      = req_ext
  x509_extensions     = x509_ext
  string_mask         = utf8only
  prompt              = no
  encrypt_key         = no
  
  [ subject ]
  countryName                    = Country Name (2 letter code)
  countryName_default            = US
  stateOrProvinceName            = State or Province Name (full name)
  stateOrProvinceName_default    = Missouri
  localityName                   = Locality Name (eg, city)
  localityName_default           = Jefferson City
  organizationName               = Organization Name (eg, company)
  organizationName_default       = My Company
  organizationalUnitName         = Organizational Unit (eg, team)
  organizationalUnitName_default = My Company Technologies
  commonName                     = Common Name (e.g. server FQDN or YOUR name)
  commonName_default             = drone-ci-web.company.com
  emailAddress                   = Email Address
  emailAddress_default           = DL_EMAIL_LIST@company.com
  
  [ x509_ext ]
  subjectKeyIdentifier   = hash
  authorityKeyIdentifier = keyid,issuer
  basicConstraints       = CA:FALSE
  keyUsage               = digitalSignature, keyEncipherment
  subjectAltName         = @alternate_names
  nsComment              = "Drone-CI - OpenSSL Generated Certificate"
  
  [ req_ext ]
  subjectKeyIdentifier = hash
  basicConstraints     = CA:FALSE
  keyUsage             = digitalSignature, keyEncipherment
  subjectAltName       = @alternate_names
  nsComment            = "Drone-CI - OpenSSL Generated Certificate"
  
  [ alternate_names ]
  DNS.1 = drone-ci-web.company.com
  </code></pre>
  
  <p>I run the following command:</p>
  
  <pre><code>sudo openssl req -x509 -config drone-ssl.cnf -new -out drone-ci-web.company.com.cert.pem
  </code></pre>
  
  <p>and I get the following error:</p>
  
  <pre><code>vagrant@jonspc ~]$ sudo openssl req -x509 -config drone-ssl.cnf -new -out drone-ci-web.ccompany.com.cert.pem
  Generating a 2048 bit RSA private key
  ..............................................................................................................+++
  ....................+++
  writing new private key to 'drone-ci-web.company.com.key.pem'
  -----
  problems making Certificate Request
  140184216713104:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:a_mbstr.c:158:maxsize=2
  </code></pre>
  
  <p>From what I think its telling me, one of the fields its trying to use is "Too long" and is only two characters, but from what I keep reading, the <code>countryName_default</code> should override the <code>countryName</code> and make this accept the value given for default.</p>
  
  <p>OpenSSL and Operating System information:</p>
  
  <pre><code>[vagrant@jonspc ~]$ openssl version
  OpenSSL 1.0.2k-fips  26 Jan 2017
  [vagrant@jonspc ~]$ cat /etc/oracle-release
  Oracle Linux Server release 7.5
  [vagrant@jonspc ~]$ cat /etc/redhat-release
  Red Hat Enterprise Linux Server release 7.5 (Maipo)
  </code></pre>
  
  <p>HOWEVER, if I remove the <code>_default</code> lines and try again, this succeeds with the following config.</p>
  
  <pre><code>[ req ]
  default_bits        = 2048
  default_md          = sha256
  default_keyfile     = drone-ci-web.company.com.key.pem
  distinguished_name  = subject
  req_extensions      = req_ext
  x509_extensions     = x509_ext
  string_mask         = utf8only
  prompt              = no
  encrypt_key         = no
  
  [ subject ]
  countryName            = US
  stateOrProvinceName    = Missouri
  localityName           = Jefferson City
  organizationName       = My Company
  organizationalUnitName = My Company Technologies
  commonName             = drone-ci-web.company.com
  emailAddress           = DL_EMAIL_LIST@company.com
  
  [ x509_ext ]
  subjectKeyIdentifier   = hash
  authorityKeyIdentifier = keyid,issuer
  basicConstraints       = CA:FALSE
  keyUsage               = digitalSignature, keyEncipherment
  subjectAltName         = @alternate_names
  nsComment              = "Drone-CI - OpenSSL Generated Certificate"
  
  [ req_ext ]
  subjectKeyIdentifier = hash
  basicConstraints     = CA:FALSE
  keyUsage             = digitalSignature, keyEncipherment
  subjectAltName       = @alternate_names
  nsComment            = "Drone-CI - OpenSSL Generated Certificate"
  
  [ alternate_names ]
  DNS.1 = drone-ci-web.company.com
  </code></pre>
  
  <p>This works with the following output. </p>
  
  <pre><code>[vagrant@jonspc ~]$ sudo openssl req -x509 -config drone-ssl.cnf -new -out drone-ci-web.company.com.cert.pem
  Generating a 2048 bit RSA private key
  ..............+++
  ..............+++
  writing new private key to 'drone-ci-web.company.com.key.pem'
  -----
  </code></pre>