diff --git a/lib/hx509/test_ca.in b/lib/hx509/test_ca.in
index 0a1b0368d..d9f3b3ef0 100644
--- a/lib/hx509/test_ca.in
+++ b/lib/hx509/test_ca.in
@@ -58,7 +58,7 @@ echo "issue certificate"
 ${hxtool} issue-certificate \
 	  --ca-certificate=FILE:$srcdir/data/ca.crt,$srcdir/data/ca.key \
 	  --subject="cn=foo" \
-	  --req="pkcs10-request.der" \
+	  --req="PKCS10:pkcs10-request.der" \
 	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "verify certificate"
@@ -107,7 +107,7 @@ ${hxtool} issue-certificate \
 	  --ca-certificate=FILE:$srcdir/data/ca.crt,$srcdir/data/ca.key \
 	  --subject="cn=foo" \
           --lifetime="10years 1 month" \
-	  --req="pkcs10-request.der" \
+	  --req="PKCS10:pkcs10-request.der" \
 	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "issue certificate (with https ekus)"
@@ -116,7 +116,7 @@ ${hxtool} issue-certificate \
 	  --subject="cn=foo" \
 	  --type="https-server" \
 	  --type="https-client" \
-	  --req="pkcs10-request.der" \
+	  --req="PKCS10:pkcs10-request.der" \
 	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "issue certificate (pkinit KDC)"
@@ -125,7 +125,7 @@ ${hxtool} issue-certificate \
 	  --subject="cn=foo" \
 	  --type="pkinit-kdc" \
           --pk-init-principal="krbtgt/TEST.H5L.SE@TEST.H5L.SE" \
-	  --req="pkcs10-request.der" \
+	  --req="PKCS10:pkcs10-request.der" \
 	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "issue certificate (pkinit client)"
@@ -134,7 +134,7 @@ ${hxtool} issue-certificate \
 	  --subject="cn=foo" \
 	  --type="pkinit-client" \
           --pk-init-principal="lha@TEST.H5L.SE" \
-	  --req="pkcs10-request.der" \
+	  --req="PKCS10:pkcs10-request.der" \
 	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "issue certificate (hostnames)"
@@ -144,7 +144,7 @@ ${hxtool} issue-certificate \
 	  --type="https-server" \
           --hostname="www.test.h5l.se" \
           --hostname="ftp.test.h5l.se" \
-	  --req="pkcs10-request.der" \
+	  --req="PKCS10:pkcs10-request.der" \
 	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "verify certificate hostname (ok)"
@@ -170,7 +170,7 @@ ${hxtool} issue-certificate \
 	  --ca-certificate=FILE:$srcdir/data/ca.crt,$srcdir/data/ca.key \
 	  --subject="cn=www.test.h5l.se" \
 	  --type="https-server" \
-	  --req="pkcs10-request.der" \
+	  --req="PKCS10:pkcs10-request.der" \
 	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "verify certificate hostname (ok)"
@@ -191,7 +191,7 @@ ${hxtool} issue-certificate \
 	  --subject="cn=foo" \
           --email="lha@test.h5l.se" \
           --email="test@test.h5l.se" \
-	  --req="pkcs10-request.der" \
+	  --req="PKCS10:pkcs10-request.der" \
 	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "issue certificate (email, null subject DN)"
@@ -199,7 +199,7 @@ ${hxtool} issue-certificate \
 	  --ca-certificate=FILE:$srcdir/data/ca.crt,$srcdir/data/ca.key \
 	  --subject="" \
           --email="lha@test.h5l.se" \
-	  --req="pkcs10-request.der" \
+	  --req="PKCS10:pkcs10-request.der" \
 	  --certificate="FILE:cert-null.pem" || exit 1
 
 echo "issue certificate (jabber)"
@@ -207,7 +207,7 @@ ${hxtool} issue-certificate \
 	  --ca-certificate=FILE:$srcdir/data/ca.crt,$srcdir/data/ca.key \
 	  --subject="cn=foo" \
           --jid="lha@test.h5l.se" \
-	  --req="pkcs10-request.der" \
+	  --req="PKCS10:pkcs10-request.der" \
 	  --certificate="FILE:cert-ee.pem" || exit 1
 
 echo "issue self-signed cert"
@@ -222,7 +222,7 @@ ${hxtool} issue-certificate \
 	  --ca-certificate=FILE:$srcdir/data/ca.crt,$srcdir/data/ca.key \
 	  --issue-ca \
 	  --subject="cn=ca-cert" \
-	  --req="pkcs10-request.der" \
+	  --req="PKCS10:pkcs10-request.der" \
 	  --certificate="FILE:cert-ca.der" || exit 1
 
 echo "issue self-signed ca cert"
@@ -237,7 +237,7 @@ echo "issue proxy certificate"
 ${hxtool} issue-certificate \
 	  --ca-certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
 	  --issue-proxy \
-	  --req="pkcs10-request.der" \
+	  --req="PKCS10:pkcs10-request.der" \
 	  --certificate="FILE:cert-proxy.der" || exit 1
 
 echo "verify proxy cert"
@@ -403,7 +403,7 @@ ${hxtool} verify --missing-revoke \
 echo "issue ee cert (crl uri)"
 ${hxtool} issue-certificate \
 	  --ca-certificate=FILE:cert-ca.pem \
-	  --req="pkcs10-request.der" \
+	  --req="PKCS10:pkcs10-request.der" \
 	  --crl-uri="http://www.test.h5l.se/crl1.crl" \
 	  --subject="cn=cert-ee-crl-uri" \
 	  --certificate="FILE:cert-ee.pem" || exit 1
@@ -411,7 +411,7 @@ ${hxtool} issue-certificate \
 echo "issue null subject cert"
 ${hxtool} issue-certificate \
 	  --ca-certificate=FILE:cert-ca.pem \
-	  --req="pkcs10-request.der" \
+	  --req="PKCS10:pkcs10-request.der" \
 	  --subject="" \
 	  --email="lha@test.h5l.se" \
 	  --certificate="FILE:cert-ee.pem" || exit 1