openssl: Error creating certificates without SKID

I get a segfault trying to sign a GOST request with extensions

        Attributes:
        Requested Extensions:
            X509v3 Key Usage: 
                Digital Signature, Non Repudiation
            X509v3 Extended Key Usage: critical
                Time Stamping
-----BEGIN CERTIFICATE REQUEST-----
MIIBkDCCAT0CAQAwgZoxFTATBgNVBAsMDE9wZW5TU0wgVGVhbTEPMA0GA1UEBwwG
TW9zY293MSowKAYDVQQDDCFUaW1lc3RhbXBpbmcgYXV0aG9yaXR5IGdvc3QyMDAx
OkExIzAhBgkqhkiG9w0BCQEWFG9wZW5zc2xAY3J5cHRvY29tLnJ1MRIwEAYDVQQK
DAlDcnlwdG9jb20xCzAJBgNVBAYTAlJVMGMwHAYGKoUDAgITMBIGByqFAwICIwEG
ByqFAwICHgEDQwAEQOzO+1/fu8a6Z+vrL65efV0+93+j8r5005A10Y/+k3iGVXQR
cr/30TMowhyYigr9AJ3OMLnzjmoy4u/fUljolhWgNjA0BgkqhkiG9w0BCQ4xJzAl
MAsGA1UdDwQEAwIGwDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDAKBgYqhQMCAgMF
AANBAGet0fxxhoRkGyKPss0GhrJ5E2cZ9uL38/NJfkXMqFQahTut1DKMo5v+PnlQ
BKw0wgdcG/+/OPsY2kKLv8W5r4E=
-----END CERTIFICATE REQUEST-----

The segfault happens executing the command OPENSSL_CONF=engine.conf openssl ca -config ca.conf -in req.pem -out cert.pem -batch -notext

The stack trace is

#0  s2i_skey_id (method=0x7ffff7ef72c0 <v3_skey_id>, ctx=0x7fffffffc6a0, str=0x4cdd0e "hash") at crypto/x509/v3_skid.c:97
#1  0x00007ffff7d44754 in do_ext_nconf (conf=0x0, ctx=0x7fffffffc6a0, ext_nid=82, crit=0, value=0x4cdd0e "hash") at crypto/x509/v3_conf.c:114
#2  0x00007ffff7d44397 in X509V3_EXT_nconf_int (conf=0x0, ctx=0x7fffffffc6a0, section=0x0, name=0x4cdd13 "subjectKeyIdentifier", value=0x4cdd0e "hash") at crypto/x509/v3_conf.c:45
#3  0x00007ffff7d44487 in X509V3_EXT_nconf (conf=0x0, ctx=0x7fffffffc6a0, name=0x4cdd13 "subjectKeyIdentifier", value=0x4cdd0e "hash") at crypto/x509/v3_conf.c:61
#4  0x0000000000487dae in adapt_keyid_ext (cert=0x5a0e70, ext_ctx=0x7fffffffc6a0, name=0x4cdd13 "subjectKeyIdentifier", value=0x4cdd0e "hash", add_default=1) at apps/lib/apps.c:1990
#5  0x0000000000487f34 in do_X509_sign (cert=0x5a0e70, pkey=0x52dd40, md=0x7ffff7ec1540 <sha256_md>, sigopts=0x0, ext_ctx=0x7fffffffc6a0) at apps/lib/apps.c:2033
#6  0x0000000000427aff in do_body (xret=0x7fffffffca10, pkey=0x52dd40, x509=0x51c950, dgst=0x7ffff7ec1540 <sha256_md>, sigopts=0x0, policy=0x509810, db=0x52ed20, serial=0x52f3f0, subj=0x0, chtype=4097, multirdn=1, email_dn=1, 
    startdate=0x50a030 "060101000000Z", enddate=0x0, days=3650, batch=1, verbose=0, req=0x52c310, ext_sect=0x0, lconf=0x4ff6c0, certopt=0, nameopt=8520479, default_op=1, ext_copy=1, selfsign=0) at apps/ca.c:1904
#7  0x00000000004267cb in certify (xret=0x7fffffffca10, infile=0x7fffffffe2b5 "tcl_tests/myvirt-gost/U_tsa_gost2001_A/req.pem", informat=32773, pkey=0x52dd40, x509=0x51c950, dgst=0x7ffff7ec1540 <sha256_md>, sigopts=0x0, vfyopts=0x0, 
    policy=0x509810, db=0x52ed20, serial=0x52f3f0, subj=0x0, chtype=4097, multirdn=1, email_dn=1, startdate=0x50a030 "060101000000Z", enddate=0x0, days=3650, batch=1, ext_sect=0x0, lconf=0x4ff6c0, verbose=0, certopt=0, nameopt=8520479, 
    default_op=1, ext_copy=1, selfsign=0) at apps/ca.c:1392
#8  0x000000000042532a in ca_main (argc=0, argv=0x7fffffffdf28) at apps/ca.c:985
#9  0x000000000044a917 in do_cmd (prog=0x4ff400, argc=9, argv=0x7fffffffdee0) at apps/openssl.c:413
#10 0x000000000044a551 in main (argc=9, argv=0x7fffffffdee0) at apps/openssl.c:295

The variable ctx->subject_req passed to x509_pubkey_hash has a suspicious value 0x3000000001

The engine.conf file is

openssl_conf = openssl_def
[openssl_def]
engines = engine_section

[engine_section]
gost = gost_section

[gost_section]
engine_id = gost
dynamic_path = /path/to/gost.so
default_algorithms = ALL
CRYPT_PARAMS = id-Gost28147-89-CryptoPro-A-ParamSet

[req]
distinguished_name = req_dn
[ req_dn ]
C = RU
L = Moscow
CN=Test srv gost2012_256:XA
O=Cryptocom
OU=OpenSSL CA
emailAddress = openssl@cryptocom.ru

The ca config is

[ ca ]
default_ca      = CA_default            # The default ca section

[ CA_default ]
dir            = /home/dbelyavs/upstream/engine/tcl_tests/myvirt-gost/RSACA              # top dir
database       = $dir/index.txt        # index file.
new_certs_dir  = $dir/newcerts         # new certs dir

certificate    = $dir/cacert.pem       # The CA cert
serial         = $dir/serial           # serial no file
private_key    = $dir/private/cakey.pem# CA private key
RANDFILE       = $dir/private/.rand    # random number file

default_days   = 3650                  # how long to certify for
default_crl_days= 30                   # how long before next CRL
default_md     = default               # use digest corresponding the algorithm
default_startdate = 060101000000Z

policy         = policy_any            # default policy
email_in_dn    = yes                   #  add the email into cert D

nameopt        = ca_default            # Subject name display option
certopt        = ca_default            # Certificate display option
copy_extensions = copy                 # Copy extensions from requ

[ policy_any ]
countryName            = supplied
stateOrProvinceName    = optional
organizationName       = optional
organizationalUnitName = optional
commonName             = supplied
emailAddress           = supplied

When I sign the RSA request using the same configs, I don’t get a segfault but get another error:

800160A4C77F0000:error:11000072:X509 V3 routines:x509_pubkey_hash:no public key:crypto/x509/v3_skid.c:64:
800160A4C77F0000:error:11000080:X509 V3 routines:X509V3_EXT_nconf_int:error in extension:crypto/x509/v3_conf.c:52:name=subjectKeyIdentifier, value=hash