Our implementation was at fault -- we should not have used MD5, and
should have set the algorithm parameter to NULL. That is now fixed.
However, we have one tiny problem with the second issuer certificate
in your PEM message (Low Assurance Certification Authority,
"RSA Data Security, Inc.", US). It uses a serial number on 40 bits
-- 0x0222000002. And our ASN.1 decoding routines immediately send
back an error report: "integer value larger than 32 bits".
As I recall from the PEM specs, serial numbers up to 128 bits s/b
supported as Steve K. notes.
One justification for such long S/Ns is that you can imagine a setup
where a MD2 or MD5 digest may be used as a S/N.
-Ray