For me it worked with using G4 WWDR, and when you create the CSR, DO NOT specify a common name.

I was having the same validation error.

Also this tool helps a lot: https://pkpassvalidator.azurewebsites.net/

It sometimes gives you suggestion for how to fix your issues. For me it was a lifesaver.