Fix cert format

backend/bdd/features/pki/acme/challenge.feature

@@ -19,4 +19,5 @@ Feature: Challenge
     Then I select challenge with type http-01 for domain localhost from order at order as challenge
     Then I serve challenge response for challenge at localhost
     Then I tell ACME server that challenge is ready to be verified
-    Then I poll and finalize the ACME order order
+    Then I poll and finalize the ACME order order as finalized_order
+    # TODO: check the content of the order

backend/bdd/features/steps/pki_acme.py

@@ -475,8 +475,9 @@ def step_impl(context: Context, var_path: str):
     acme_client.answer_challenge(challenge, response)
 
 
-@then("I poll and finalize the ACME order {var_path}")
+@then("I poll and finalize the ACME order {var_path} as {finalized_var}")
-def step_impl(context: Context, var_path: str):
+def step_impl(context: Context, var_path: str, finalized_var: str):
     order = eval_var(context, var_path, as_json=False)
     acme_client = context.acme_client
-    acme_client.poll_and_finalize(order)
+    finalized_order = acme_client.poll_and_finalize(order)
+    context.vars[finalized_var] = finalized_order

backend/src/ee/routes/v1/pki-acme-router.ts

@@ -380,6 +380,7 @@ export const registerPkiAcmeRouter = async (server: FastifyZodProvider) => {
       if (payload !== "") {
         throw new AcmeMalformedError({ detail: "Payload should be empty" });
       }
+      res.type("application/pem-certificate-chain");
       return sendAcmeResponse(
         res,
         profileId,

backend/src/ee/services/pki-acme/pki-acme-service.ts

@@ -683,7 +683,13 @@ export const pkiAcmeServiceFactory = ({
     }
     return {
       status: 200,
-      body: order.certificate! + "\n" + order.certificateChain!,
+      body:
+        order.certificate!.trim().replace("\n", "\r\n") +
+        "\r\n" +
+        order.certificateChain!.trim().replace("\n", "\r\n") +
+        // The final line is needed, otherwise some clients will not parse the certificate chain correctly
+        // ref: https://github.com/certbot/certbot/blob/4d5d5f7ae8164884c841969e46caed8db1ad34af/certbot/src/certbot/crypto_util.py#L506-L514
+        "\r\n",
       headers: {
         Location: buildUrl(profileId, `/orders/${orderId}/certificate`),
         Link: `<${buildUrl(profileId, "/directory")}>;rel="index"`