pfSense

you have to look in the asn1 informations of the certificates.
some tools (Novell for Example) write the whole subject in one field, and this makes it unuseable
i have no windows CA, can you upload the certificate file ? and the csr file ?

This looks okay in asn1 notation. Do you have the csr file ?

Not sure if I can get a hold of the csr, as the certificate is generated by going to the Windows CA certificate request site, pasting in the request above, and choosing the "Web Server" template. When that's done, you get the .cer file above.

I'm not really sure whether the order does matter or not. If it does not, maybe it should search for each of the fields in the returned subject.

Should there possibly be an option to force it to accept it anyway even if it doesn't seem to match according to the checks? (the information could be a match but could be in an unrecognized layout)

Well, as I said, I'm not too familiar with how certificates work. But I would guess that it computes some sort of hash of the requested values, just to make sure that the request has not been tampered with. And so when the signed certificates hash does not match, it rejects it.

I just tried this last night, and still get the same error. Would be nice if someone else with a Windows CA could test this. Just so make sure it's not a misconfiguration on my part, hehe :p

One way around this might be to alter the certificate template, as I guess that is what formats how the result looks (where the fields are, and all that)?

The message you mentioned is shown simply when a certain string comparison fails. If it would be appropriate, it could try to match up fields instead.

Possibly this is related to format of the cer ie DER....
So this must be an argument that must be supplied during importing to openvpn.
More digging needed on how to find the format!

After checking this more thoroughly this seems to be just about the diff in the created subject.

Another method should be used to match this rather than comparing strings.

I am still evaluating the best option.

I will try it out sometime during the weekend, and get back to you.

Thanks! :D

Using the latest snapshot [2.0-BETA5 (i386) built on Fri Jan 7 15:25:33 EST 2011], it still shows the error:
The certificate subject [content removed] does not match the signing request subject; the same error as in the description for this bug.

I do not think that patch is in a Jan 7 snapshot.
Please try a more recent one.

Ok i fixed even the CSR. Can you please try the latest snapshot or the do the last patch listed here manually?

I think you fixed the problem. With the snapshot [2.0-BETA5 (i386) built on Wed Jan 12 18:38:12 EST 2011] I am able to import the certificate without any error.