The openssl_csr docs use “should” where (at least following IETF nomenclature) “must” would be more accurate. See #53141 +label: docsite_pr