          printf "(Longer than %d days). " "${RENEW_DAYS}"
          if [[ "${force_renew}" = "yes" ]]; then
            echo "Ignoring because renew was forced!"
-@@ -667,7 +674,7 @@
+@@ -682,7 +689,7 @@
  
    echo "Revoking ${cert}"
  
 -  cert64="$(openssl x509 -in "${cert}" -inform PEM -outform DER | urlbase64)"
 +  cert64="$(${OPENSSL} x509 -in "${cert}" -inform PEM -outform DER | urlbase64)"
-   response="$(signed_request "${CA_REVOKE_CERT}" '{"resource": "revoke-cert", "certificate": "'"${cert64}"'"}')"
+   response="$(signed_request "${CA_REVOKE_CERT}" '{"resource": "revoke-cert", "certificate": "'"${cert64}"'"}' | clean_json)"
    # if there is a problem with our revoke request _request (via signed_request) will report this and "exit 1" out
    # so if we are here, it is safe to assume the request was successful

       givennames="$(echo "${domain}" "${morenames}"| tr ' ' '\n' | sort -u | tr '\n' ' ' | _sed 's/ $//' | _sed 's/^ //')"
 
       if [[ "${certnames}" = "${givennames}" ]]; then
@@ -598,10 +605,10 @@
 
     if [[ -e "${cert}" ]]; then
       echo " + Checking expire date of existing cert..."

   crt="$( printf -- '-----BEGIN CERTIFICATE-----\n%s\n-----END CERTIFICATE-----\n' "${crt64}" )"
 
   # Try to load the certificate to detect corruption
@@ -530,7 +537,7 @@
   tmp_openssl_cnf="$(_mktemp)"
   cat "${OPENSSL_CNF}" > "${tmp_openssl_cnf}"
   printf "[SAN]\nsubjectAltName=%s" "${SAN}" >> "${tmp_openssl_cnf}"
-  openssl req -new -sha256 -key "${BASEDIR}/certs/${domain}/${privkey}" -out "${BASEDIR}/certs/${domain}/cert-${timestamp}.csr" -subj "/CN=${domain}/" -reqexts SAN -config "${tmp_openssl_cnf}"
