Comment 2 for bug 1690287

Thanks Luke for making us aware!

Note/TL;DR: this is openssl 1.0/1.1 fallout, the Debian bug has much more history one it already and Luke is proposing a fix there which we should pick up into 17.04 then as well.

I could confirm this affecting all releases back to trusty which makes me wonder if I'm doing something wrong as I'm certainly no pkcs expert :-/
Need to be revisited once Debian acks on the fix - but to me atm it seems this never worked?! which makes it lower prio than it seems at first.