{"action":"opened","issue":{"url":"https://api.github.com/repos/cloudflare/cfssl/issues/156","labels_url":"https://api.github.com/repos/cloudflare/cfssl/issues/156/labels{/name}","comments_url":"https://api.github.com/repos/cloudflare/cfssl/issues/156/comments","events_url":"https://api.github.com/repos/cloudflare/cfssl/issues/156/events","html_url":"https://github.com/cloudflare/cfssl/issues/156","id":67882533,"number":156,"title":"Unable to clear C, ST, O, OU, L in CSR","user":{"login":"jcjones","id":518542,"avatar_url":"https://avatars.githubusercontent.com/u/518542?v=3","gravatar_id":"","url":"https://api.github.com/users/jcjones","html_url":"https://github.com/jcjones","followers_url":"https://api.github.com/users/jcjones/followers","following_url":"https://api.github.com/users/jcjones/following{/other_user}","gists_url":"https://api.github.com/users/jcjones/gists{/gist_id}","starred_url":"https://api.github.com/users/jcjones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jcjones/subscriptions","organizations_url":"https://api.github.com/users/jcjones/orgs","repos_url":"https://api.github.com/users/jcjones/repos","events_url":"https://api.github.com/users/jcjones/events{/privacy}","received_events_url":"https://api.github.com/users/jcjones/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-04-12T07:30:19Z","updated_at":"2015-04-12T07:30:19Z","closed_at":null,"body":"The recently added method `replaceSliceIfEmpty` from [aeaf899bba868e70ba78c478be99b7b4cb266915](https://github.com/cloudflare/cfssl/commit/aeaf899bba868e70ba78c478be99b7b4cb266915#diff-8d79bfc4bb0987be2c41ab248b24b30fR118) interferes with clearing unwanted Name fields.\r\n\r\nThe logic today chooses to copy the CSR-supplied Name fields if the signer.Subject object includes strings of length 0.\r\n\r\nWe need to be able to clear these fields, as we cannot trust the user's input, but passing strings of length 0 no longer does the trick. Of course, we can't send nil pointers either.\r\n\r\nWe need some better way to indicate to CFSSL to discard the CSR names."}}