This is an otherwise valid TBSCertificate, however it lacks a version (making it v1). As such extensions are not allowed. $ openssl asn1parse -i < [TBS CERTIFICATE] 0:d=0 hl=2 l= 62 cons: SEQUENCE 2:d=1 hl=2 l= 1 prim: INTEGER :01 5:d=1 hl=2 l= 3 cons: SEQUENCE 7:d=2 hl=2 l= 1 prim: OCTET STRING [HEX DUMP]:01 10:d=1 hl=2 l= 3 cons: SEQUENCE 12:d=2 hl=2 l= 1 prim: OCTET STRING [HEX DUMP]:05 15:d=1 hl=2 l= 30 cons: SEQUENCE 17:d=2 hl=2 l= 13 prim: UTCTIME :121018031200Z 32:d=2 hl=2 l= 13 prim: UTCTIME :131018145959Z 47:d=1 hl=2 l= 3 cons: SEQUENCE 49:d=2 hl=2 l= 1 prim: OCTET STRING [HEX DUMP]:83 52:d=1 hl=2 l= 3 cons: SEQUENCE 54:d=2 hl=2 l= 1 prim: OCTET STRING [HEX DUMP]:F3 57:d=1 hl=2 l= 5 cons: cont [ 3 ] 59:d=2 hl=2 l= 3 cons: SEQUENCE 61:d=3 hl=2 l= 1 prim: OCTET STRING [HEX DUMP]:DD -----BEGIN TBS CERTIFICATE----- MD4CAQEwAwQBATADBAEFMB4XDTEyMTAxODAzMTIwMFoXDTEzMTAxODE0NTk1OVowAwQBgzADBAH zowUwAwQB3Q== -----END TBS CERTIFICATE-----