The "cert / precert mismatch" error when submit an pre-cert

[LeviMarvin]

When submit a pre-cert, the log server will say "AddChain handler error: failed to verify add-chain contents: cert / precert mismatch: bool".

[AlCutter]

Hi Levi,

You'd expect to get this error if you're calling add-chain with a Precertificate (precerts should be logged using a call to add-pre-chain). Could this be what's happening in your case?

As an aside, we should probably look at improving the error text (@phbnf for triaging that).

[LeviMarvin]

@AlCutter I just submit the precertificate included full chain.
Root->Sub2CA->Precertificate
or
Root->Sub2CA->Pre-IssuerCA->Precertificate

[LeviMarvin]

@AlCutter This error occurring submit the precertificate by using ct-submit tools, if i using ctclient to upload, it will be recording to the logs tree and i will get the SCT information like this:

Uploading pre-certificate to log
Uploaded chain of 4 certs to V1 log at (removed), timestamp: 1660753611294 (2022-08-18 00:26:51.294 +0800 CST)
LogID: (removed)
LeafHash: 82b173e608690d2327050455ca9c90bbc8f6edee622eba0a057596bf41cda5e6
Signature: Signature: Hash=SHA256 Sign=ECDSA Value=3046022100cfaf220dd7520d47bfa8b3e667f127688110db70e21f06129598bb8d785bf95e022100e3d43743cb5d15d559b51910ad5c8c51432b4dbb52dcefa3d6ef6b1737625d3d

And also a question, how can i add these SCT information to certificate with openssl? Maybe it need the data that encoded with DER.