diff --git a/doc/apps/req.pod b/doc/apps/req.pod
index 10e4e12a5cdae51456a2c097544c89e3fbd86d5b..7a3b6bb99d3705981a0fb06c24b34b5ee7fcb8d2 100644
--- a/doc/apps/req.pod
+++ b/doc/apps/req.pod
@@ -512,13 +512,13 @@ Sample configuration containing all field values:
 
 The header and footer lines in the B<PEM> format are normally:
 
- -----BEGIN CERTIFICATE REQUEST----
- -----END CERTIFICATE REQUEST----
+ -----BEGIN CERTIFICATE REQUEST-----
+ -----END CERTIFICATE REQUEST-----
 
 some software (some versions of Netscape certificate server) instead needs:
 
- -----BEGIN NEW CERTIFICATE REQUEST----
- -----END NEW CERTIFICATE REQUEST----
+ -----BEGIN NEW CERTIFICATE REQUEST-----
+ -----END NEW CERTIFICATE REQUEST-----
 
 which is produced with the B<-newhdr> option but is otherwise compatible.
 Either form is accepted transparently on input.
diff --git a/doc/apps/smime.pod b/doc/apps/smime.pod
index fa5d23e8dc3bc99c05a2d58af0f19f6bce17fe92..2453dd2738d11d26a1718b2a24f3f8c1ef765c36 100644
--- a/doc/apps/smime.pod
+++ b/doc/apps/smime.pod
@@ -340,8 +340,8 @@ detached signature format. You can use this program to verify the
 signature by line wrapping the base64 encoded structure and surrounding
 it with:
 
- -----BEGIN PKCS7----
- -----END PKCS7----
+ -----BEGIN PKCS7-----
+ -----END PKCS7-----
 
 and using the command, 
 
diff --git a/doc/apps/x509.pod b/doc/apps/x509.pod
index 9f7eba4c87e2bacbd4245e263812003a9f17ca6c..0b53fb1cf88ab6069d86e25c42527a283b7e89ef 100644
--- a/doc/apps/x509.pod
+++ b/doc/apps/x509.pod
@@ -643,18 +643,18 @@ Set a certificate to be trusted for SSL client use and change set its alias to
 
 The PEM format uses the header and footer lines:
 
- -----BEGIN CERTIFICATE----
- -----END CERTIFICATE----
+ -----BEGIN CERTIFICATE-----
+ -----END CERTIFICATE-----
 
 it will also handle files containing:
 
- -----BEGIN X509 CERTIFICATE----
- -----END X509 CERTIFICATE----
+ -----BEGIN X509 CERTIFICATE-----
+ -----END X509 CERTIFICATE-----
 
 Trusted certificates have the lines
 
- -----BEGIN TRUSTED CERTIFICATE----
- -----END TRUSTED CERTIFICATE----
+ -----BEGIN TRUSTED CERTIFICATE-----
+ -----END TRUSTED CERTIFICATE-----
 
 The conversion to UTF8 format used with the name options assumes that
 T61Strings use the ISO8859-1 character set. This is wrong but Netscape