From c510d841b8ab0e8df10b63333f4c3555e0f427a8 Mon Sep 17 00:00:00 2001 From: Fang-Pen Lin Date: Thu, 13 Nov 2025 12:02:05 -0800 Subject: [PATCH] Fix wrong CSR format --- backend/src/ee/services/pki-acme/pki-acme-service.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/backend/src/ee/services/pki-acme/pki-acme-service.ts b/backend/src/ee/services/pki-acme/pki-acme-service.ts index a41f1ee5f..dadb809d0 100644 --- a/backend/src/ee/services/pki-acme/pki-acme-service.ts +++ b/backend/src/ee/services/pki-acme/pki-acme-service.ts @@ -729,6 +729,8 @@ export const pkiAcmeServiceFactory = ({ return { certificateId: result.certificateId }; } const { certificateAuthority } = (await certificateProfileDAL.findByIdWithConfigs(profileId, tx))!; + const csrObj = new x509.Pkcs10CertificateRequest(csr); + const csrPem = csrObj.toString("pem"); // TODO: for internal CA, we rely on the internal certificate authority service to check CSR against the template // we should check the CSR against the template here // TODO: this is pretty slow, and we are holding the transaction open for a long time, @@ -738,7 +740,7 @@ export const pkiAcmeServiceFactory = ({ caId: certificateAuthority!.id, commonName: certificateRequest.commonName!, altNames: certificateRequest.subjectAlternativeNames?.map((san) => san.value), - csr: Buffer.from(csr), + csr: Buffer.from(csrPem), // TODO: not 100% sure what are these columns for, but let's put the values for common website SSL certs for now keyUsages: [CertKeyUsage.DIGITAL_SIGNATURE, CertKeyUsage.KEY_ENCIPHERMENT, CertKeyUsage.KEY_AGREEMENT], extendedKeyUsages: [CertExtendedKeyUsage.SERVER_AUTH]