This seems to qualify as a bug:

The sed version included in my Linux seems to be unstable when using the '\s' and/or '\S' regex extensions:

Example:

id@pc:~$ echo '[ subCA2 ]' | sed -n 's|^\[\s\+\([^\s]\+[0-9]\+\)\s\+\]\s*$|\1|p'
id@pc:~$ echo '[ subCA2 ]' | sed -n 's:^\[\s\+\([\S]\+[0-9]\+\)\s\+\]\s*$:\1:p'
id@pc:~$ echo '[ rootCA1 ]' | sed -n 's|^\[\s\+\([^\s]\+[0-9]\+\)\s\+\]\s*$|\1|p'
rootCA1

If I replace '\s' with '[ \t]' (and '\S' with '[^ \t]') things work as expected:
id@pc:~$ echo '[ subCA2 ]' | sed -n 's:^\[[ \t]\+\([^ \t]\+[0-9]\+\)[ \t]\+\][ \t]*$:\1:p'
subCA2
id@pc:~$ echo '[ rootCA2 ]' | sed -n 's:^\[[ \t]\+\([^ \t]\+[0-9]\+\)[ \t]\+\][ \t]*$:\1:p'
rootCA2

-------------------------------------------------------------------------------------------------
My Linux version:
Debian 12.10 as per 2025-04-02, terminal session in an Xfce4 desktop environment, fully updated:

My sed version:
id@pc:~$ sed --version
sed (GNU sed) 4.9
Packaged by Debian
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Jay Fenlason, Tom Lord, Ken Pizzini,
Paolo Bonzini, Jim Meyering, and Assaf Gordon.

This sed program was built with SELinux support.
SELinux is disabled on this system.

GNU sed home page: <https://www.gnu.org/software/sed/>.
General help using GNU software: <https://www.gnu.org/gethelp/>.
E-mail bug reports to: <bug-sed@gnu.org>.
id@pc:~$
-------------------------------------------------------------------------------------------------

Regards,
Vidar Hanto
Norway