Customer reported the following issue.

They have generated the ASN.1 structure of the PCKS#10 generated by keytool.
They are seeing the following structure

  0 30 422: SEQUENCE {
 
   4 30 271: SEQUENCE {
 
   8 02 1: INTEGER 0
 
  11 30 102: SEQUENCE {
 
  13 31 19: SET {
 
  15 30 17: SEQUENCE {
 
  17 06 10: OBJECT IDENTIFIER '0 9 2342 19200300 100 1 25'
 
  29 13 3: PrintableString 'com'
 
            : }
 
            : }
 
  34 31 20: SET {
 
  36 30 18: SEQUENCE {
 
  38 06 10: OBJECT IDENTIFIER '0 9 2342 19200300 100 1 25'
 
  50 13 4: PrintableString 'fhlb'
 
According to the RFC 3280,

-- Naming attributes of type DomainComponent (from RFC 2247)
id-domainComponent AttributeType ::=
                          { 0 9 2342 19200300 100 1 25 }
DomainComponent ::= IA5String

The DomainComponent has to be of type IAS5String.
Instead, it is showing PrintableString.

Customer suspect a bug in the keytool.