What format of csr parameter in ACME protocol

Client dev
#1

invoke /acme/order/xxxx/finalize API

request is


protected: {
  "alg": "ES256", 
  "kid": "https://acme-staging-v02.api.letsencrypt.org/acme/acct/...", 
  "nonce": "0003dDiXOmkQnGE6QwzQqaxzZIauoqN7WmfKdrUllakbOsI", 
  "url": "https://acme-staging-v02.api.letsencrypt.org/acme/finalize/.../..."
}
payload: {
  "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIICvzCCAacCAQAwejELMAkGA1UEBhMCQ04xEjAQBgNVBAgMCUJKIFN0cmVldDEQ\nMA4GA1UEBwwHQmVpamluZzESMBAGA1UECgwJUWluZ0Nsb3VkMRcwFQYDVQQLDA5E\nZXYgRGVwYXJ0bWVudDEYMBYGA1UEAwwPbGV0c2VuY3J5cHQudG9wMIIBIjANBgkq\nhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt6snycLptLaARz3Dwq6jtToUd3jIa6wu\nEkg8b4kP62vba50qDvBDbvrOAZU8+4WZka3HFmyMNHANklFugJIC6FhSKpu23JLs\n9jO2tDJ2a8szpBrpFH355mSGr+Rw59HVQDJbyiq5LbjvuARWU9SMnXllFIvLZShU\nAXWjWCshvKWqJZ4M0l06SvCxxWXaDSqc7FLW2BjB8Y4FgehkH5g+yE9sawz6QqpL\n26TFYP4DfOsd91mtJjLJojEJ4lTfHRO/YVqLzgNdCNYil3/ib+uogci5CE6sVf2C\nAy/Y1zf1Gh1QAYd/KxH96L5XyrBWKkaGUjMH2dBr8M0eSIk6qCIgxwIDAQABoAAw\nDQYJKoZIhvcNAQELBQADggEBAD6G17rOy5qDM4W5hy1PDLmKEg/OQDrF9X0MclrN\ntDw1ecvI4qd/ZYdvWna4bQx0B+KLjsIEffQdr8K+fff6ARxf9SBpt3gzpYWsrNe3\n+TWAXkAfv4zu3lcGWWu4VmG/6/kn/Rf6rlweACnKRhpSB7ZmeDfHTlPJ6kdu5ets\n7KtVEkCD7fZjADVxMYeOMAuClF2bmsL7GCH6nz2ELqPKS8N3BNJW+HDQe3rBgeQs\nvnV8daG1KQ7N4XZ7+2ug3AAqcMKADBeAZq3Tneq7ZQCQNAxkXgqTaFauqNaYTUJg\nugbgMmvNNvCeKCOTB50szgd1JYtk47W6knf9awRyMh1pKLg=\n-----END CERTIFICATE REQUEST-----"
}
  signature: 'xxxxx'

and get this response

======= header =========
{
  'Content-Length': '126', 
  'Cache-Control': 'public, max-age=0, no-cache', 
  'Server': 'nginx', 
  'Connection': 'keep-alive', 
  'Link': '<https://acme-staging-v02.api.letsencrypt.org/directory>;rel="index"', 
  'Boulder-Requester': '17092284', 
  'Date': 'Mon, 21 Dec 2020 08:06:29 GMT', 
  'Content-Type': 'application/problem+json', 
  'Replay-Nonce': '00047wzsrbO10bJC-6BnN_Wm3TdUUUumNWeNH5Fl06reoAk'
}

======== body =========
{
  u'detail': u'Error unmarshaling finalize order request',
  u'status': 400,
  u'type': u'urn:ietf:params:acme:error:malformed'
}

屏幕快照 2020-12-21 15.34.46
屏幕快照 2020-12-21 15.34.46895×522 62 KB

Question is what format or encoding type of csr string parameter in the payload?

I have tried the DER format, but got same error response.

1 Like
Does ACME have CSR standard?
#2

Try it without the header, footer, and newlines:

  "csr": "MIICvzCCAacCAQAwejELMAkGA1UEBhMCQ04xEjAQBgNVBAgMCUJKIFN0cmVldDEQ\nMA4GA1UEBwwHQmVpamluZzESMBAGA1UECgwJUWluZ0Nsb3VkMRcwFQYDVQQLDA5E\nZXYgRGVwYXJ0bWVudDEYMBYGA1UEAwwPbGV0c2VuY3J5cHQudG9wMIIBIjANBgkq\nhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt6snycLptLaARz3Dwq6jtToUd3jIa6wu\nEkg8b4kP62vba50qDvBDbvrOAZU8+4WZka3HFmyMNHANklFugJIC6FhSKpu23JLs\n9jO2tDJ2a8szpBrpFH355mSGr+Rw59HVQDJbyiq5LbjvuARWU9SMnXllFIvLZShU\nAXWjWCshvKWqJZ4M0l06SvCxxWXaDSqc7FLW2BjB8Y4FgehkH5g+yE9sawz6QqpL\n26TFYP4DfOsd91mtJjLJojEJ4lTfHRO/YVqLzgNdCNYil3/ib+uogci5CE6sVf2C\nAy/Y1zf1Gh1QAYd/KxH96L5XyrBWKkaGUjMH2dBr8M0eSIk6qCIgxwIDAQABoAAw\nDQYJKoZIhvcNAQELBQADggEBAD6G17rOy5qDM4W5hy1PDLmKEg/OQDrF9X0MclrN\ntDw1ecvI4qd/ZYdvWna4bQx0B+KLjsIEffQdr8K+fff6ARxf9SBpt3gzpYWsrNe3\n+TWAXkAfv4zu3lcGWWu4VmG/6/kn/Rf6rlweACnKRhpSB7ZmeDfHTlPJ6kdu5ets\n7KtVEkCD7fZjADVxMYeOMAuClF2bmsL7GCH6nz2ELqPKS8N3BNJW+HDQe3rBgeQs\nvnV8daG1KQ7N4XZ7+2ug3AAqcMKADBeAZq3Tneq7ZQCQNAxkXgqTaFauqNaYTUJg\nugbgMmvNNvCeKCOTB50szgd1JYtk47W6knf9awRyMh1pKLg="}
1 Like
#3

But I saw the '\n' in your csr parameter

#4

Where?
After the end quote?

1 Like
#5

Oh , it does not work.

#6

em.... you can find it . '\n'

"csr": "MIICvzCCAacCAQAwejELMAkGA1UEBhMCQ04xEjAQBgNVBAgMCUJKIFN0cmVl
dDEQ\nMA4
GA1UEBwwHQmVpamluZzESMBAGA1UECgwJUWluZ0Nsb3VkMRcwFQYDVQQLDA
5E\nZXY
gRGVwYXJ0bWVudDEYMBYGA1UEAwwPbGV0c2VuY3J5cHQudG9wMIIBIjANB
gkq\nhkiG9w
0BAQEFAAOCAQ8AMIIBCgKCAQEAt6snycLptLaARz3Dwq6jtToUd3jIa
6wu\nEkg8b4kP
62vba50qDvBDbvrOAZU8+4WZka3HFmyMNHANklFugJIC6FhSKpu23
JLs\n9jO2tDJ2a8s
zpBrpFH355mSGr+Rw59HVQDJbyiq5LbjvuARWU9SMnXllFIv
LZShU\nAXWjW
CshvKWqJZ4M0l06SvCxxWXaDSqc7FLW2BjB8Y4FgehkH5g+yE9saw
z6QqpL\n26TFYP4
DfOsd91mtJjLJojEJ4lTfHRO/YVqLzgNdCNYil3/ib+uogci5CE6sVf2C\nAy/Y1zf1Gh1QAYd/KxH96L5XyrBWKkaGUjMH2dBr8M0eSIk6qCIgxwIDAQABoAAw\nDQYJKoZIhvcNAQELBQADggEBAD6G17rOy5qDM4W5hy1PDLmKEg/OQDrF9X0MclrN\ntDw1ecvI4qd/ZYdvWna4bQx0B+KLjsIEffQdr8K+fff6ARxf9SBpt3gzpYWsrNe3\n+TWAXkAfv4zu3lcGWWu4VmG/6/kn/Rf6rlweACnKRhpSB7ZmeDfHTlPJ6kdu5ets\n7KtVEkCD7fZjADVxMYeOMAuClF2bmsL7GCH6nz2ELqPKS8N3BNJW+HDQe3rBgeQs\nvnV8daG1KQ7N4XZ7+2ug3AAqcMKADBeAZq3Tneq7ZQCQNAxkXgqTaFauqNaYTUJg\nugbgMmvNNvCeKCOTB50szgd1JYtk47W6knf9awRyMh1pKLg="}

Did you see it ?

#7

The CSR field is the base64url(der) encoding without padding of the DER version (bytes) of your CSR, so the content is base64 encoded without any newlines or padding characters.

1 Like
#8

See: How do I debug this? - Client dev - Let's Encrypt Community Support

1 Like
#9

As far as I know,

DER file is encoded into a binary content.

How to remove the newline character in it ?

1 Like
#10 

    csr_file = open('./CSR.csr.der', 'r')
    csr_str = csr_file.read()
    print csr_str

    req_url = 'https://acme-staging-v02.api.letsencrypt.org/acme/finalize/xxx/xxx'
    kid = 'https://acme-staging-v02.api.letsencrypt.org/acme/acct/xxx'
    resp_headers, resp_body = send_to_letsencrypt(
        url=req_url,
        protected_header=protected_header_,
        payload={
            'csr': csr_str
        },
        account_key_dict=key_dict,
        account_url=kid
    )
    pp(resp_headers)
    pp(resp_body)
#11

What you post here is altered.
Unless you use three backticsks above and below your post.

```
your post
```

As shown, yes, there are spaces and returns:
image

1 Like
#12

Oh, did you see the '\n' before the yellow area?

#13

Unless you show that function/procedure, there is no way to know.

1 Like
#14

DER is a binary (bytes) format and doesn't look like text. If your file looks like MIICvzCCAacCAQAwejELMAkGA1UEBhMCQ04xEjAQBgNVBAgMCUJKIFN0cmVl
dDEQ etc then it's actually a PEM file (base64 encoded with padding characters). You need the same thing converted to bytes and then base64url encoded.

1 Like
#15

屏幕快照 2020-12-21 16.26.39
屏幕快照 2020-12-21 16.26.391439×372 59.1 KB

here is the raw DER file

I just use the origin python way to open the DER file.

1 Like
#16

It can't have spaces - so that is just incorrect (or this site is altering your posted text).

#17

Where are you going with that?
A. it needs to be PEM encoded
B. What does the procedre csr_file.read() do?

1 Like
#18

All of which should be happening in this one line:

1 Like
#19

em...

Base64url on payload will be done in the function send_to_letsencrypt()

#20

Let's begin at the begining...
Your initial post shows:
image
followed by:
image

don't you see how those two are different?

1 Like