Parsec-tool encodes countryName element of DN as UTF8STRING. At least Openssl and Wireshark expect it to be a PRINTABLESTRING instead.