This is a TBSCertificate which has a serial number that is 26 octets long. This violates RFC 5280. $ openssl asn1parse -i < [TBS CERTIFICATE] 0:d=0 hl=2 l= 85 cons: SEQUENCE 2:d=1 hl=2 l= 3 cons: cont [ 0 ] 4:d=2 hl=2 l= 1 prim: INTEGER :00 7:d=1 hl=2 l= 26 prim: INTEGER :42C83C785552E43927E48BE1280FA20F9FB08F47F944C32668F9 35:d=1 hl=2 l= 3 cons: SEQUENCE 37:d=2 hl=2 l= 1 prim: OCTET STRING [HEX DUMP]:01 40:d=1 hl=2 l= 3 cons: SEQUENCE 42:d=2 hl=2 l= 1 prim: OCTET STRING [HEX DUMP]:05 45:d=1 hl=2 l= 30 cons: SEQUENCE 47:d=2 hl=2 l= 13 prim: UTCTIME :121018031200Z 62:d=2 hl=2 l= 13 prim: UTCTIME :131018145959Z 77:d=1 hl=2 l= 3 cons: SEQUENCE 79:d=2 hl=2 l= 1 prim: OCTET STRING [HEX DUMP]:83 82:d=1 hl=2 l= 3 cons: SEQUENCE 84:d=2 hl=2 l= 1 prim: OCTET STRING [HEX DUMP]:F3 -----BEGIN TBS CERTIFICATE----- MFWgAwIBAAIaQsg8eFVS5Dkn5IvhKA+iD5+wj0f5RMMmaPkwAwQBATADBAEFMB4XDTEyMTAxODA zMTIwMFoXDTEzMTAxODE0NTk1OVowAwQBgzADBAHz -----END TBS CERTIFICATE-----