Urn:acme:error:malformed - Error unmarshaling certificate request

fixitek · July 15, 2016, 2:29pm

Hello,

I am writing my own client in PHP, and I have stuck on sending CSR because I’m getting

 ["type"]=> string(24) "urn:acme:error:malformed" ["detail"]=> string(38) "Error unmarshaling certificate request" ["status"]=> int(400)

I believe there is some problem in CSR generation algorithm or something like that.

Here is code example:

$result = $this->signedRequest(
 '/acme/new-cert',
[
'resource' => 'new-cert',
'csr' => $csr,
]);

I have performed domain verification with success with similar code, so I assume it’s sending good requests to endpoint.

value of $csr is:

Generated by PHP, but all online parsers are OK with this CSR, but when I send it I only got in return the said error.

This error message is not very verbose so I have stuck on this one.

pfg · July 15, 2016, 2:46pm

Are you using the right encoding for the csr parameter? Here’s what the spec says:

   csr (required, string):  A CSR encoding the parameters for the
      certificate being requested.  The CSR is sent in the
      Base64-encoded version of the DER format.  (Note: This field uses
      the same modified Base64-encoding rules used elsewhere in this
      document, so it is different from PEM.)

Here’s some relevant code from another PHP client, might be worth comparing with your implementation:

github.com

kelunik/acme/blob/165208964473f52334a5991601b027bde87c7265/lib/AcmeService.php#L346


if ($endPos === false) {
    throw new InvalidArgumentException("Invalid CSR, maybe not in PEM format?\n{$csr}");
}


$csr = substr($csr, 0, $endPos);


$enc = new Base64UrlSafeEncoder;


/** @var Response $response */
$response = (yield $this->acmeClient->post(AcmeResource::NEW_CERTIFICATE, [
    "csr" => $enc->encode(base64_decode($csr)),
]));


if ($response->getStatus() === 201) {
    if (!$response->hasHeader("location")) {
        throw new AcmeException("Protocol Violation: No Location Header");
    }


    yield new CoroutineResult(current($response->getHeader("location")));
    return;
}

You might even be able to reuse code from that project.

There are some less-obvious issues with Go (which boulder, the CA server behind Let’s Encrypt, uses) choking on some CSRs, though I’m not sure if that would trigger this particular error message. I think one of the issues was related to the X509 version field being set to zero, or something like that.

fixitek · July 18, 2016, 8:22am

I have re-implemented my code based on this fragment and it seems like malformed problem went away . Problem was with base64 encoding of cert.

Thank you!

system · August 17, 2016, 8:22am

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Problem with CSR for only one DNS name Client dev	22	8216	October 23, 2016
Status 400: Error unmarshaling certificate request Client dev	12	3708	November 18, 2016
A error response about /finalize API Client dev	7	680	January 20, 2021
Problem Issuing EC-384 Certificate Help	10	4710	February 2, 2016
API returns error "urn:ietf:params:acme:error:malformed" Help	12	11544	June 17, 2021

Urn:acme:error:malformed - Error unmarshaling certificate request

Related topics