[vitormattos]

Summary

Fixes #9366: signer CSRs use LibreSign's generated OpenSSL configuration, not the host system openssl.cnf. That configuration is reused for X.509 certificate signing; issuer-dependent extensions are applied only at signing time.

Regression tests

• Named PHPUnit data provider covers 8 signer-subject combinations: CN only, C/L only, ST only, O only, C/L/ST, C/L/O, all configured fields, and placeholder-like values intentionally supplied by the signer.
• Each data set asserts the exact relevant DN fields and values from the issued certificate, catching both missing explicit fields and unexpected injected fields.
• A separate partial-mock integration test checks that the leaf CSR receives the generated config and req section. This fails deterministically if the original unconfigured openssl_csr_new() call returns, regardless of the CI worker's system defaults.
• Existing certificate key-usage, SAN and revocation tests remain independent.

Validation

• PHP syntax of the replacement test methods checked with PHP 8.4: passed.
• The original PR's local PHP 8.3 crypto reproduction showed the unwanted O/ST defaults disappear with the explicit config while key usage is retained.
• The prior PR head's PHPUnit matrix failed because the old regression test incorrectly expected C=DE to be inherited from the root. This has been replaced with explicit signer-subject inputs.
• PHPUnit full integration matrix on the new head is pending CI. The earlier isolated NCDD attempt could not start because Docker on that host had exhausted its network address pools.

Previously issued certificates are unchanged. The separate pre-existing root-to-signer field-inheritance behavior is not modified in this PR.

[github-actions]

Code Metrics Report

	main (b02d0b8)	#9430 (2032f12)	+/-
Coverage	76.1%	76.2%	+0.0%
Test Execution Time	1s	2s	+1s

Details

  |                     | main (b02d0b8) | #9430 (2032f12) |  +/-  |
  |---------------------|----------------|-----------------|-------|
+ | Coverage            |          76.1% |           76.2% | +0.0% |
  |   Files             |            500 |             500 |     0 |
  |   Lines             |          28578 |           28581 |    +3 |
+ |   Covered           |          21776 |           21780 |    +4 |
- | Test Execution Time |             1s |              2s |   +1s |

Code coverage of files in pull request scope (75.1% → 75.3%, patch 100.0%)

Files	Coverage	+/-	Patch Coverage	Status
apps/libresign/lib/Handler/CertificateEngine/AEngineHandler.php	66.6%	+0.1%	-	affected
lib/Handler/CertificateEngine/OpenSslHandler.php	91.0%	+0.0%	100.0%	modified

---

Reported by octocov