As I recall, I used the instructions from StartCom for preparing the certificate request. At the time, they were the only source of free ssl certs and I was too cheap to spend money testing other cert providers.  I never noticed that the header was incorrect, but given what happened to StartCom, I'm not surprised they weren't following proper procedures.  I thought that this functionality was replaced by Let's Encrypt.