I'm not sure if this is a user error or a bug. I didn't see a way to
tell OpenSSL to not require that Country be in the CSR.
Check that the request matches the signature
The Subject's Distinguished Name is as follows
commonName :PRINTABLE:'Certificate Authority'
The mandatory countryName field was missing
I didn't see anything in Trac regarding this.
Freeipa-devel mailing list