When entering Cyrillic characters into  certificate DN fields
such as Common Name or Organization, make-ssl-cert produces certificate
with invalid latin-1 character sequences instead of cyrillic.

Problem can be fixed (at least in UTF-8 locale) by adding two
lines into [req]  section of the /usr/share/ssl-cert/ssleay.conf:

utf8=yes ; forces OpenSSL to interpret configuration file as UTF-8
string_mask=pkix ; forces to use ASN.1 encoding compatible with most CA

(really, may be better to use string_mask = utf8only, because it would
work with CJK languages)

See req(1ssl) manpage for detailed rescription of these directives.

For correct support of non-utf8 locales, user answers should be
converted from locale encoding to UTF-8, because openssl utility
supports only Latin-1 and Utf-8 in configuration files.