title: Certificate Request Info on a PKCS#10 to be signed
body: <p>I'm doing a code that has to create a PKCS#10. To do that, I have to sign my "Certificate Request Info", but when I do, the application says that the signature is invalid.</p>
  
  <p>I'm using the OpenSSL.exe to verify the P10, and the error was:
  "ANS1_CHECK_TLEN: wrong tag". I think I'm signing what I shouldn't, so my question is, what's the exact format of "Certificate Request Info" that I have to sign?</p>
  
  <p>I know that it must start with a sequence, but the p10 spec tells: </p>
  
  <p>"The signature process consists of two steps:</p>
  
  <ol>
  <li>The value of the certificationRequestInfo component is DER
  encoded, yielding an octet string.</li>
  <li>The result of step 1 is signed with the certification request
  subject’s private key under the specified signature
  algorithm, yielding a bit string, the signature."</li>
  </ol>
  
  <p>I'm not sure if the start must be a SEQUENCE (0x30 0x82 "the length>256"), or A OCTET STRING (0x04 0x82 "the length>256"), acording to ANS.1.</p>
  
  <p>If someone please give me an answer like on this post, i could be the happiest man on the world. Thank very much:</p>
  
  <p><a href="https://stackoverflow.com/questions/967762/pkcs10-request-for-a-object-key-pair-from-pkcs11">PKCS#10 request for a object key pair from PKCS#11</a></p>
  
  <p>REgards, David M.</p>