Upload Certificate using API

Hi folks,
I've started having a play around with XG. I have a PowerShell script for generating a new Let's Encrypt certificate and updating my various components that use it, and wanted to integrate this with XG Home. It looks like the obvious way of achieving this should be the API, but I'm struggling a little with the certificate upload.

I've taken a look at the documentation and fired off a few API calls successfully, but the upload operation is a little different as it references data in a multipart request.
I'm using the v16.5 documentation because the v17 docs appear to be missing this particular page (it appears in the menu but the link is broken because the AddCertificate&UpdateCertificate.html file is missing).
I am not a developer but I did a bit of Googling and have come up with what I think is a multipart request. A Fiddler trace shows this when I fire off my request (PFX file data redacted and passwords changed).
POST sophos:4444/.../APIController
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.16299.251
Content-Type: multipart/mixed; boundary=Certificate_File_Upload
Host: sophos:4444
Content-Length: 2712
Connection: Keep-Alive
Content-Disposition: attachment; filename="test.pfx"
Content-Type: application/x-pkcs12
<<<<Encoded PFX data here>>>>

Tidying that up for readability the decoded XML in the URL is:
  <Set operation="add">
The response I get from the API is: <Status code="510">Operation failed. Deleting entity referred by another entity.</Status>
Going by the documentation this means "Certificate could not be uploaded due to invalid private key or passphrase. Choose a proper key".
I've also tried a version with the certificate and key in PEM format rather than PFX and get: <Status code="500">Operation could not be performed on Entity.</Status>
Going by the documentation this means "Certificate could not be updated".
I tried a multipart/form-data request initially, but the API didn't provide any feedback - I got an HTTP 200 response, but no XML in the body. The multipart/mixed version at least responds with some XML so I'm assuming that's what it wants.
I'm assuming there's something wrong with the way I'm uploading the PFX file - perhaps I've misunderstood what the multipart request should look like? I couldn't find an example in the docs. The encoded PFX file data looks correct though, because it appears to be the same in Fiddler when I upload the PFX via the web UI (successfully). I was hoping one of you might have tried this and could point me in the right direction, please?
  • In reply to rrosson:

    The 'Set operation="update"' works fine for me. This is the output that I see at the weekly update:

    <?xml version="1.0" encoding="UTF-8"?>
    <Response APIVersion="1702.1" IPS_CAT_VER="1">
        <status>Authentication Successful</status>
      <Certificate transactionid="">
        <Status code="200">Configuration applied successfully.</Status>
  • In reply to DunRon:

    But is the certificate in use with anything? Mine is configured to be used with the portal (admin/user) as well as e-mail.  Are you doing anything manually on Sunday's?  Just want to make sure I am not missing anything.

  • In reply to rrosson:

    Yes, it's in use and selected in SYSTEM, Administration, Admin settings. Not performing any manual action, this just works as described.

    Maybe you can find out more by checking the log files?

  • In reply to DunRon:

    Ok, found the issue. It appears to have been a permissions issue. All fixed and running properly

  • In reply to rrosson:

    Can you elaborate on the permission issue? I'm having the same problem