What format of csr parameter in ACME protocol

Client dev
1

invoke /acme/order/xxxx/finalize API

request is


protected: {
  "alg": "ES256", 
  "kid": "https://acme-staging-v02.api.letsencrypt.org/acme/acct/...", 
  "nonce": "0003dDiXOmkQnGE6QwzQqaxzZIauoqN7WmfKdrUllakbOsI", 
  "url": "https://acme-staging-v02.api.letsencrypt.org/acme/finalize/.../..."
}
payload: {
  "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIICvzCCAacCAQAwejELMAkGA1UEBhMCQ04xEjAQBgNVBAgMCUJKIFN0cmVldDEQ\nMA4GA1UEBwwHQmVpamluZzESMBAGA1UECgwJUWluZ0Nsb3VkMRcwFQYDVQQLDA5E\nZXYgRGVwYXJ0bWVudDEYMBYGA1UEAwwPbGV0c2VuY3J5cHQudG9wMIIBIjANBgkq\nhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt6snycLptLaARz3Dwq6jtToUd3jIa6wu\nEkg8b4kP62vba50qDvBDbvrOAZU8+4WZka3HFmyMNHANklFugJIC6FhSKpu23JLs\n9jO2tDJ2a8szpBrpFH355mSGr+Rw59HVQDJbyiq5LbjvuARWU9SMnXllFIvLZShU\nAXWjWCshvKWqJZ4M0l06SvCxxWXaDSqc7FLW2BjB8Y4FgehkH5g+yE9sawz6QqpL\n26TFYP4DfOsd91mtJjLJojEJ4lTfHRO/YVqLzgNdCNYil3/ib+uogci5CE6sVf2C\nAy/Y1zf1Gh1QAYd/KxH96L5XyrBWKkaGUjMH2dBr8M0eSIk6qCIgxwIDAQABoAAw\nDQYJKoZIhvcNAQELBQADggEBAD6G17rOy5qDM4W5hy1PDLmKEg/OQDrF9X0MclrN\ntDw1ecvI4qd/ZYdvWna4bQx0B+KLjsIEffQdr8K+fff6ARxf9SBpt3gzpYWsrNe3\n+TWAXkAfv4zu3lcGWWu4VmG/6/kn/Rf6rlweACnKRhpSB7ZmeDfHTlPJ6kdu5ets\n7KtVEkCD7fZjADVxMYeOMAuClF2bmsL7GCH6nz2ELqPKS8N3BNJW+HDQe3rBgeQs\nvnV8daG1KQ7N4XZ7+2ug3AAqcMKADBeAZq3Tneq7ZQCQNAxkXgqTaFauqNaYTUJg\nugbgMmvNNvCeKCOTB50szgd1JYtk47W6knf9awRyMh1pKLg=\n-----END CERTIFICATE REQUEST-----"
}
  signature: 'xxxxx'

and get this response

======= header =========
{
  'Content-Length': '126', 
  'Cache-Control': 'public, max-age=0, no-cache', 
  'Server': 'nginx', 
  'Connection': 'keep-alive', 
  'Link': '<https://acme-staging-v02.api.letsencrypt.org/directory>;rel="index"', 
  'Boulder-Requester': '17092284', 
  'Date': 'Mon, 21 Dec 2020 08:06:29 GMT', 
  'Content-Type': 'application/problem+json', 
  'Replay-Nonce': '00047wzsrbO10bJC-6BnN_Wm3TdUUUumNWeNH5Fl06reoAk'
}

======== body =========
{
  u'detail': u'Error unmarshaling finalize order request',
  u'status': 400,
  u'type': u'urn:ietf:params:acme:error:malformed'
}

屏幕快照 2020-12-21 15.34.46
屏幕快照 2020-12-21 15.34.46895×522 62 KB

Question is what format or encoding type of csr string parameter in the payload?

I have tried the DER format, but got same error response.

1 Like
2

Try it without the header, footer, and newlines:

  "csr": "MIICvzCCAacCAQAwejELMAkGA1UEBhMCQ04xEjAQBgNVBAgMCUJKIFN0cmVldDEQ\nMA4GA1UEBwwHQmVpamluZzESMBAGA1UECgwJUWluZ0Nsb3VkMRcwFQYDVQQLDA5E\nZXYgRGVwYXJ0bWVudDEYMBYGA1UEAwwPbGV0c2VuY3J5cHQudG9wMIIBIjANBgkq\nhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt6snycLptLaARz3Dwq6jtToUd3jIa6wu\nEkg8b4kP62vba50qDvBDbvrOAZU8+4WZka3HFmyMNHANklFugJIC6FhSKpu23JLs\n9jO2tDJ2a8szpBrpFH355mSGr+Rw59HVQDJbyiq5LbjvuARWU9SMnXllFIvLZShU\nAXWjWCshvKWqJZ4M0l06SvCxxWXaDSqc7FLW2BjB8Y4FgehkH5g+yE9sawz6QqpL\n26TFYP4DfOsd91mtJjLJojEJ4lTfHRO/YVqLzgNdCNYil3/ib+uogci5CE6sVf2C\nAy/Y1zf1Gh1QAYd/KxH96L5XyrBWKkaGUjMH2dBr8M0eSIk6qCIgxwIDAQABoAAw\nDQYJKoZIhvcNAQELBQADggEBAD6G17rOy5qDM4W5hy1PDLmKEg/OQDrF9X0MclrN\ntDw1ecvI4qd/ZYdvWna4bQx0B+KLjsIEffQdr8K+fff6ARxf9SBpt3gzpYWsrNe3\n+TWAXkAfv4zu3lcGWWu4VmG/6/kn/Rf6rlweACnKRhpSB7ZmeDfHTlPJ6kdu5ets\n7KtVEkCD7fZjADVxMYeOMAuClF2bmsL7GCH6nz2ELqPKS8N3BNJW+HDQe3rBgeQs\nvnV8daG1KQ7N4XZ7+2ug3AAqcMKADBeAZq3Tneq7ZQCQNAxkXgqTaFauqNaYTUJg\nugbgMmvNNvCeKCOTB50szgd1JYtk47W6knf9awRyMh1pKLg="}
1 Like
3

But I saw the '\n' in your csr parameter

4

Where?
After the end quote?

1 Like
5

Oh , it does not work.

6

em.... you can find it . '\n'

"csr": "MIICvzCCAacCAQAwejELMAkGA1UEBhMCQ04xEjAQBgNVBAgMCUJKIFN0cmVl
dDEQ\nMA4
GA1UEBwwHQmVpamluZzESMBAGA1UECgwJUWluZ0Nsb3VkMRcwFQYDVQQLDA
5E\nZXY
gRGVwYXJ0bWVudDEYMBYGA1UEAwwPbGV0c2VuY3J5cHQudG9wMIIBIjANB
gkq\nhkiG9w
0BAQEFAAOCAQ8AMIIBCgKCAQEAt6snycLptLaARz3Dwq6jtToUd3jIa
6wu\nEkg8b4kP
62vba50qDvBDbvrOAZU8+4WZka3HFmyMNHANklFugJIC6FhSKpu23
JLs\n9jO2tDJ2a8s
zpBrpFH355mSGr+Rw59HVQDJbyiq5LbjvuARWU9SMnXllFIv
LZShU\nAXWjW
CshvKWqJZ4M0l06SvCxxWXaDSqc7FLW2BjB8Y4FgehkH5g+yE9saw
z6QqpL\n26TFYP4
DfOsd91mtJjLJojEJ4lTfHRO/YVqLzgNdCNYil3/ib+uogci5CE6sVf2C\nAy/Y1zf1Gh1QAYd/KxH96L5XyrBWKkaGUjMH2dBr8M0eSIk6qCIgxwIDAQABoAAw\nDQYJKoZIhvcNAQELBQADggEBAD6G17rOy5qDM4W5hy1PDLmKEg/OQDrF9X0MclrN\ntDw1ecvI4qd/ZYdvWna4bQx0B+KLjsIEffQdr8K+fff6ARxf9SBpt3gzpYWsrNe3\n+TWAXkAfv4zu3lcGWWu4VmG/6/kn/Rf6rlweACnKRhpSB7ZmeDfHTlPJ6kdu5ets\n7KtVEkCD7fZjADVxMYeOMAuClF2bmsL7GCH6nz2ELqPKS8N3BNJW+HDQe3rBgeQs\nvnV8daG1KQ7N4XZ7+2ug3AAqcMKADBeAZq3Tneq7ZQCQNAxkXgqTaFauqNaYTUJg\nugbgMmvNNvCeKCOTB50szgd1JYtk47W6knf9awRyMh1pKLg="}

Did you see it ?

7

The CSR field is the base64url(der) encoding without padding of the DER version (bytes) of your CSR, so the content is base64 encoded without any newlines or padding characters.

1 Like
8

See: How do I debug this? - Client dev - Let's Encrypt Community Support

1 Like
9

As far as I know,

DER file is encoded into a binary content.

How to remove the newline character in it ?

1 Like
10 

    csr_file = open('./CSR.csr.der', 'r')
    csr_str = csr_file.read()
    print csr_str

    req_url = 'https://acme-staging-v02.api.letsencrypt.org/acme/finalize/xxx/xxx'
    kid = 'https://acme-staging-v02.api.letsencrypt.org/acme/acct/xxx'
    resp_headers, resp_body = send_to_letsencrypt(
        url=req_url,
        protected_header=protected_header_,
        payload={
            'csr': csr_str
        },
        account_key_dict=key_dict,
        account_url=kid
    )
    pp(resp_headers)
    pp(resp_body)
11

What you post here is altered.
Unless you use three backticsks above and below your post.

```
your post
```

As shown, yes, there are spaces and returns:
image

1 Like
12

Oh, did you see the '\n' before the yellow area?

13

Unless you show that function/procedure, there is no way to know.

1 Like
14

DER is a binary (bytes) format and doesn't look like text. If your file looks like MIICvzCCAacCAQAwejELMAkGA1UEBhMCQ04xEjAQBgNVBAgMCUJKIFN0cmVl
dDEQ etc then it's actually a PEM file (base64 encoded with padding characters). You need the same thing converted to bytes and then base64url encoded.

1 Like
15

屏幕快照 2020-12-21 16.26.39
屏幕快照 2020-12-21 16.26.391439×372 59.1 KB

here is the raw DER file

I just use the origin python way to open the DER file.

1 Like
16

It can't have spaces - so that is just incorrect (or this site is altering your posted text).

17

Where are you going with that?
A. it needs to be PEM encoded
B. What does the procedre csr_file.read() do?

1 Like
18

All of which should be happening in this one line:

1 Like
19

em...

Base64url on payload will be done in the function send_to_letsencrypt()

20

Let's begin at the begining...
Your initial post shows:
image
followed by:
image

don't you see how those two are different?

1 Like