Also seems as if some other fields have strange looking values in them:

X509v3 CRL Distribution Points: 
    .:URI:http://some.url/revoked.crl
Authority Information Access: 
    .8OCSP;URI:http://some.url/ocsp

Certificates generated by MRI look like this:

X509v3 CRL Distribution Points: 
    Full Name:
      URI:http://some.url/revoked.crl

Authority Information Access: 
    OCSP - URI:http://some.url/ocsp

This info was all output using "openssl x509 -text -in /path/to/generated.crt"

I found these problems when moving my certificate authority from MRI to JRuby. OpenVPN for example started complaining about plaintext errors and clients with certificates generated by jruby could not connect. Removing all these fields from the generated certificates makes openvpn happy but it's really jruby that is in error somewhere.

The error openvpn gives is this (or similar ones anyway depending on which of the fields above you leave in the certificates):

TLS_ERROR: BIO read tls_read_plaintext error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag: error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error

These things would probably be somewhere in:

https://github.com/jruby/jruby/blob/master/ext/openssl/src/main/java/org/jruby/ext/openssl/X509Extensions.java

this particular issue has been fixed along the way, let us know if its still an issue.

@kares I still had the issue (v0.10.2)

When running this code (create a slef signed cert with crl)

require 'openssl'

key = OpenSSL::PKey::RSA.new(4096)

subject = "/C=FR/ST=IDF/L=PARIS/O=Company/CN=myhost.example"

cert = OpenSSL::X509::Certificate.new
cert.subject = cert.issuer = OpenSSL::X509::Name.parse(subject)

cert.not_before = Time.now
cert.not_after = Time.now + 365*24*60*60
cert.public_key = key.public_key
cert.serial = 0x0
cert.version = 2

ef = OpenSSL::X509::ExtensionFactory.new
ef.subject_certificate = ef.issuer_certificate = cert

cert.add_extension ef.create_extension('basicConstraints', 'CA:FALSE', true)
cert.add_extension ef.create_extension('keyUsage', 'keyEncipherment,dataEncipherment,digitalSignature')
cert.add_extension ef.create_extension('subjectKeyIdentifier', 'hash')
cert.add_extension ef.create_extension('authorityKeyIdentifier', 'keyid:always,issuer:always')
cert.add_extension ef.create_extension('crlDistributionPoints', "URI:http://example.com")

cert.sign key, OpenSSL::Digest::SHA256.new

File.open("/tmp/cert.pem", "w"){ |f| f.write cert.to_pem }

puts cert.to_text

cert.to_text returns

X509v3 CRL Distribution Points: 
    URI:http://example.com

where openssl x509 -noout -text -in /tmp/cert.pem returns

X509v3 CRL Distribution Points: 
    ..URI:http://example.com

So unittests validate the cert.to_text output and pass, there is something (like an extra bit) added in to_pem or to_text ignore this.

@ahmet2mir to_text details might not be 100% accurate, are the other parts problematic for you?
in any case, please open a new issue with details instead of commenting on a closed one. thanks.