user87971: I am writing transactions manually and have stumbled across a rather bizarre situation.
Only one in a few of the transactions I broadcast to bitcoind is accepted, otherwise I get a REJECT_NONSTANDARD (Non-canonical DER signature).
So I got my hands dirty and tracked the rejection to be originating from this line: https://github.com/bitcoin/bitcoin/blob/9c5f0d542d1db507b3b9c87bd9de6d0d758d51c1/src/script/interpreter.cpp#L163
I read about DER encoding and checked how IsValidSignatureEncoding is enforcing it, but I do not know why OpenSSL generates not-DER-compliant (r, s) values?
How should I overcome this? I am thinking of something along the lines of (pseudocode):
Pair (r, s);
do
{
   (r, s) = sign(hash, pvtkey);
} while (r[0] >= 128 || s[0] >= 128); // where r[0], s[0] should be the very first byte of each value

But isn't that kind of redundant? Can I give OpenSSL any flag to produce a valid DER (R, S) pair in the first place?

user76567: A possible reason is that Bitcoin Core expects a low S value. Try changing s with N-s if s > N/2 (N is the curve order).
Source here

87971: <p>I am writing transactions manually and have stumbled across a rather bizarre situation.</p>

<p>Only one in a few of the transactions I broadcast to bitcoind is accepted, otherwise I get a <code>REJECT_NONSTANDARD</code> (Non-canonical DER signature).</p>

<p>So I got my hands dirty and tracked the rejection to be originating from this line: <a href="https://github.com/bitcoin/bitcoin/blob/9c5f0d542d1db507b3b9c87bd9de6d0d758d51c1/src/script/interpreter.cpp#L163" rel="nofollow noreferrer">https://github.com/bitcoin/bitcoin/blob/9c5f0d542d1db507b3b9c87bd9de6d0d758d51c1/src/script/interpreter.cpp#L163</a></p>

<p>I read about DER encoding and checked how <code>IsValidSignatureEncoding</code> is enforcing it, but I do not know why OpenSSL generates not-DER-compliant (r, s) values?</p>

<p>How should I overcome this? I am thinking of something along the lines of (pseudocode):</p>

<pre><code>Pair (r, s);
do
{
   (r, s) = sign(hash, pvtkey);
} while (r[0] &gt;= 128 || s[0] &gt;= 128); // where r[0], s[0] should be the very first byte of each value
</code></pre>

<p>But isn't that kind of redundant? Can I give OpenSSL any flag to produce a valid DER (R, S) pair in the first place?</p>
 76567: <p>A possible reason is that Bitcoin Core expects a low S value. Try changing s with N-s if s > N/2 (N is the curve order).</p>

<p>Source <a href="https://github.com/bitcoin/bips/blob/master/bip-0062.mediawiki#low-s-values-in-signatures" rel="nofollow noreferrer">here</a></p>
