Подписание CSR с помощью Java не проверяется с использованием OpenSSL

public static X509Certificate certFromFile(String path) {
    X509Certificate cert;
    try {
        CertificateFactory fact = CertificateFactory.getInstance("X.509");
        FileInputStream is = new FileInputStream(path);
        cert = (X509Certificate) fact.generateCertificate(is);
    } catch (CertificateException | FileNotFoundException e) {
        String error = e.getMessage();
        System.err.println(error);
        return null;
    }
    return cert;
}

public static String DumpCert(X509Certificate cert) {

    ByteArrayOutputStream out = new ByteArrayOutputStream();
    try {
        out.write("-----BEGIN CERTIFICATE-----\n".getBytes());
        out.write(Base64.encode(cert.getEncoded()));
        out.write("\n-----END CERTIFICATE-----\n".getBytes());
        out.close();
    } catch (IOException | CertificateEncodingException e) {
        System.out.println(e.getMessage());
    }

    String certpem = null;
    try {
        certpem = new String(out.toByteArray(), "ISO-8859-1");
    } catch (UnsupportedEncodingException e) {
        System.out.println(e.getMessage());
    }
    return certpem;
}

public static ContentSigner createSigner(PrivateKey privateKey) {
    try {
        ContentSigner sig = new JcaContentSignerBuilder("SHA256withECDSA").build(privateKey);
        return sig;
    } catch (Exception e) {
        throw new RuntimeException("Could not create content signer.", e);
    }
}

public static String signCSR(PKCS10CertificationRequest csr, GeneralName san, int validity,
                             X509Certificate cacert, KeyStore keystore, String alias) throws Exception {

    Date from = new Date();
    Date to = new Date(System.currentTimeMillis() + (validity * 86400000L));

    PrivateKey cakey = null;
    try {
        cakey = (PrivateKey) keystore.getKey(alias, null);
    } catch (Exception e) {
        System.out.println(e.getMessage());
    }

    GeneralNames subjectAltNames = new GeneralNames(san);

    org.bouncycastle.asn1.x500.X500Name csrSubject = csr.getSubject();
    X500Name issuer = new X500Name(cacert.getSubjectX500Principal().getName());
    X500Name caName = X500Name.getInstance(PrincipalUtil.getIssuerX509Principal(cacert).getEncoded());

    GeneralNames gn = new GeneralNames(new GeneralName(caName));

    BigInteger serial = new BigInteger(32, new SecureRandom());

    SubjectPublicKeyInfo keyinfo = csr.getSubjectPublicKeyInfo();

    DigestCalculator digCalc = new BcDigestCalculatorProvider().get(new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1));
    X509ExtensionUtils x509ExtensionUtils = new X509ExtensionUtils(digCalc);

    X509v3CertificateBuilder certgen = new X509v3CertificateBuilder(issuer, serial, from, to, csrSubject, keyinfo);
    BigInteger serialcert = cacert.getSerialNumber();
    Boolean buildCACert = true;

    PublicKey caKey = cacert.getPublicKey();
    SubjectPublicKeyInfo keyinfoCA = SubjectPublicKeyInfo.getInstance(caKey.getEncoded());

    AuthorityKeyIdentifier akiMain = x509ExtensionUtils.createAuthorityKeyIdentifier(keyinfoCA);
    AuthorityKeyIdentifier aki = new AuthorityKeyIdentifier(akiMain.getKeyIdentifier(), gn, serialcert);

    certgen.addExtension(Extension.basicConstraints, false, new BasicConstraints(buildCACert));
    certgen.addExtension(Extension.subjectKeyIdentifier, false, x509ExtensionUtils.createSubjectKeyIdentifier(keyinfo));
    certgen.addExtension(Extension.authorityKeyIdentifier, false, aki);
    certgen.addExtension(Extension.subjectAlternativeName, false, subjectAltNames);

    ContentSigner signer = createSigner(cakey);
    X509CertificateHolder holder = certgen.build(signer);

    X509Certificate cert = null;
    try {
        CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
        InputStream in = new ByteArrayInputStream(holder.getEncoded());
        cert = (X509Certificate) certFactory.generateCertificate(in);
    } catch (CertificateException | IOException e) {
        System.out.println(e.getMessage());
    }

    return DumpCert(cert);
}

public static GeneralName getSubjectAlternativeName(PKCS10CertificationRequest csr) {
    org.bouncycastle.asn1.pkcs.Attribute[] certAttributes = csr.getAttributes();
    for (org.bouncycastle.asn1.pkcs.Attribute attribute : certAttributes) {
        if (attribute.getAttrType().equals(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest)) {
            Extensions extensions = Extensions.getInstance(attribute.getAttrValues().getObjectAt(0));
            GeneralNames gns = GeneralNames.fromExtensions(extensions, Extension.subjectAlternativeName);
            GeneralName name = gns.getNames()[0];
            return name;
        }
    }
    return null;
}

public static String PrepAndSignCSR(String raw_csr, String certPath, String keystore) {

    KeyStore ks = null;
    Object parsedObject = null;
    String alias = "alias";
    String s = null;
    X509Certificate caCert = null;

    StringReader sr = new StringReader(raw_csr);
    PEMParser pemParser = new PEMParser(sr);

    try {
        parsedObject = pemParser.readObject();
        System.out.println("PemParser returned : " + parsedObject);
    } catch (IOException e) {
        String error = e.getMessage();
        System.err.println(error);
    }

    PKCS10CertificationRequest CSR = (PKCS10CertificationRequest) parsedObject;
    caCert = certFromFile(certPath);

    try {
        ks = KeyStore.getInstance("ncipher.sworld", "nCipherKM");
        FileInputStream in = new FileInputStream(keystore);
        ks.load(in, null);
    } catch (KeyStoreException |
            NoSuchAlgorithmException |
            CertificateException |
            IOException |
            NoSuchProviderException e) {
        System.err.println(e.getMessage());
    }

    GeneralName san = getSubjectAlternativeName(CSR);
    try {
        String cert = signCSR(CSR, san, 3500, caCert, ks, alias);
        return cert;
    } catch (Exception e) {
        String error = e.getMessage();
        System.err.println(error);
    }
    return null;
}

public static void main(String[] args) {

    .
    .
    .
    String fini = PrepAndSignCSR(csr, caCertPath, keystore);
    System.out.println(fini);

}

}