# Buggy code
def _generate_csr(self):
    req = crypto.X509Req()
    req.set_version(self.version - 1)
    subject = req.get_subject()
    for entry in self.subject:
        if entry[1] is not None:
            # Workaround for https://github.com/pyca/pyopenssl/issues/165
            nid = OpenSSL._util.lib.OBJ_txt2nid(to_bytes(entry[0]))
            OpenSSL._util.lib.X509_NAME_add_entry_by_NID(
                subject._name,
                nid,
                OpenSSL._util.lib.MBSTRING_UTF8,
                to_bytes(entry[1]),
                -1,
                -1,
                0,
            )

    extensions = []
    if self.subjectAltName:
        altnames = ", ".join(self.subjectAltName)
        extensions.append(
            crypto.X509Extension(
                b"subjectAltName",
                self.subjectAltName_critical,
                altnames.encode("ascii"),
            )
        )

    if self.keyUsage:
        usages = ", ".join(self.keyUsage)
        extensions.append(
            crypto.X509Extension(
                b"keyUsage", self.keyUsage_critical, usages.encode("ascii")
            )
        )

    if self.extendedKeyUsage:
        usages = ", ".join(self.extendedKeyUsage)
        extensions.append(
            crypto.X509Extension(
                b"extendedKeyUsage",
                self.extendedKeyUsage_critical,
                usages.encode("ascii"),
            )
        )

    if self.basicConstraints:
        usages = ", ".join(self.basicConstraints)
        extensions.append(
            crypto.X509Extension(
                b"basicConstraints",
                self.basicConstraints_critical,
                usages.encode("ascii"),
            )
        )

    if self.ocspMustStaple:
        extensions.append(
            crypto.X509Extension(
                OPENSSL_MUST_STAPLE_NAME,
                self.ocspMustStaple_critical,
                OPENSSL_MUST_STAPLE_VALUE,
            )
        )

    if extensions:
        req.add_extensions(extensions)

    req.set_pubkey(self.privatekey)
    req.sign(self.privatekey, self.digest)
    self.request = req

    return crypto.dump_certificate_request(crypto.FILETYPE_PEM, self.request)


# Traceback (nOpenSSL.crypto.Error)
fatal: [HOSTNAME]: FAILED! => {"changed": false, "module_stderr": "Shared connection to HOSTNAME closed.\r\n", "module_stdout": "Traceback (most recent call last):\r\n  File \"/home/cadams/.ansible/tmp/ansible-tmp-1551387765.173323-188954571970605/AnsiballZ_openssl_csr.py\", line 113, in <module>\r\n    _ansiballz_main()\r\n  File \"/home/cadams/.ansible/tmp/ansible-tmp-1551387765.173323-188954571970605/AnsiballZ_openssl_csr.py\", line 105, in _ansiballz_main\r\n    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\r\n  File \"/home/cadams/.ansible/tmp/ansible-tmp-1551387765.173323-188954571970605/AnsiballZ_openssl_csr.py\", line 48, in invoke_module\r\n    imp.load_module('__main__', mod, module, MOD_DESC)\r\n  File \"/tmp/ansible_openssl_csr_payload_RVRDYd/__main__.py\", line 602, in <module>\r\n  File \"/tmp/ansible_openssl_csr_payload_RVRDYd/__main__.py\", line 580, in main\r\n  File \"/tmp/ansible_openssl_csr_payload_RVRDYd/__main__.py\", line 381, in generate\r\n  File \"/usr/lib64/python2.7/site-packages/OpenSSL/crypto.py\", line 779, in __init__\r\n    _raise_current_error()\r\n  File \"/usr/lib64/python2.7/site-packages/OpenSSL/_util.py\", line 54, in exception_from_error_queue\r\n    raise exception_type(errors)\r\nOpenSSL.crypto.Error: [('X509 V3 routines', 'v2i_GENERAL_NAME_ex', 'missing value'), ('X509 V3 routines', 'X509V3_EXT_nconf', 'error in extension')]\r\n", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}

# Fixed code
def _generate_csr(self):
    req = crypto.X509Req()
    req.set_version(self.version - 1)
    subject = req.get_subject()
    for entry in self.subject:
        if entry[1] is not None:
            # Workaround for https://github.com/pyca/pyopenssl/issues/165
            nid = OpenSSL._util.lib.OBJ_txt2nid(to_bytes(entry[0]))
            OpenSSL._util.lib.X509_NAME_add_entry_by_NID(
                subject._name,
                nid,
                OpenSSL._util.lib.MBSTRING_UTF8,
                to_bytes(entry[1]),
                -1,
                -1,
                0,
            )

    extensions = []
    if self.subjectAltName:
        altnames = ", ".join(self.subjectAltName)
        try:
            extensions.append(
                crypto.X509Extension(
                    b"subjectAltName",
                    self.subjectAltName_critical,
                    altnames.encode("ascii"),
                )
            )
        except OpenSSL.crypto.Error as e:
            raise CertificateSigningRequestError(
                'Error while parsing Subject Alternative Names {0} (check for missing type prefix, such as "DNS:"!): {1}'.format(
                    ", ".join(["{0}".format(san) for san in self.subjectAltName]),
                    str(e),
                )
            )

    if self.keyUsage:
        usages = ", ".join(self.keyUsage)
        extensions.append(
            crypto.X509Extension(
                b"keyUsage", self.keyUsage_critical, usages.encode("ascii")
            )
        )

    if self.extendedKeyUsage:
        usages = ", ".join(self.extendedKeyUsage)
        extensions.append(
            crypto.X509Extension(
                b"extendedKeyUsage",
                self.extendedKeyUsage_critical,
                usages.encode("ascii"),
            )
        )

    if self.basicConstraints:
        usages = ", ".join(self.basicConstraints)
        extensions.append(
            crypto.X509Extension(
                b"basicConstraints",
                self.basicConstraints_critical,
                usages.encode("ascii"),
            )
        )

    if self.ocspMustStaple:
        extensions.append(
            crypto.X509Extension(
                OPENSSL_MUST_STAPLE_NAME,
                self.ocspMustStaple_critical,
                OPENSSL_MUST_STAPLE_VALUE,
            )
        )

    if extensions:
        req.add_extensions(extensions)

    req.set_pubkey(self.privatekey)
    req.sign(self.privatekey, self.digest)
    self.request = req

    return crypto.dump_certificate_request(crypto.FILETYPE_PEM, self.request)