Upload Certificate using API

Hi Andrew,

Looks like you are close to a working solution. I too - just as you have tried - create a multipart/form-data object (System.Net.Http.MultipartFormDataContent).

My request looks something like the following (highlighted in yellow where I believe you need to adjust):

With this approach I get the following response:

<?xml version="1.0" encoding="UTF-8"?>
<Response APIVersion="1700.1">
  <Login>
    <status>Authentication Successful</status>
  </Login>
  <Certificate transactionid="">
    <Status code="200">Configuration applied successfully.</Status>
  </Certificate>
</Response>

Also remember that you cannot upload a certificate with a name that already exists. You need to create a new unique name each time (then update all references to use the new and then delete the old).

A final note here is that it seems that firewall rules that have Path-specific routing looses some of its configuration on update (in my case the Allowed Client Networks). Haven't fully investigated what I'm doing wrong here, but to me it seems to be a bug in the API as I on update return the same configuration the API gives me...

Hope this helps!

Trond

Hi Trond and Andrew,

Firstly, thanks for the detailed question, it has helped me get closer to uploading the cert. I think.

This is the PowerShell script that I have got so far (based a lot off this page: http://blog.majcica.com/2016/01/13/powershell-tips-and-tricks-multipartform-data-requests/)

$ContentType = "application/octet-stream"
$certFile = "C:\temp\LE_cert.pfx"
$fileName = Split-Path $certFile -leaf
$boundary = [guid]::NewGuid().ToString()
$fileBin = [System.IO.File]::ReadAllBytes($certFile)

$enc = [System.Text.Encoding]::GetEncoding("iso-8859-1")

$template = @'
   --{0}
   Content-Type: application/xml; charset=utf-8
   Content-Disposition: form-data; name=reqxml
   <Request>
      <Login>
         <Username>apiUSER</Username>
         <Password>apiPWD</Password>
      </Login>
      <Set operation="add">
         <Certificate>
            <Name>LE_tcxapi_20181105_cert</Name>
            <Action>UploadCertificate</Action>
            <CertificateFormat>pkcs12</CertificateFormat>
            <Password>pwd</Password>
            <CertificateFile>{1}</CertificateFile>
         </Certificate>
      </Set>
   </Request>
   --{0}
   Content-Disposition: form-data; filename="{1}"; name="Unique"
   Content-Type: {2}
   {3}
   --{0}--
'@

$body = $template -f $boundary, $fileName, $ContentType, $enc.GetString($fileBin)
 

$response = Invoke-WebRequest -UseBasicParsing -Headers $headers -Uri 'fw-exg-00:4444/.../APIController operation="add"><Certificate><Name>MHA_TEST_Cert</Name><Action>UploadCertificate</Action><CertificateFormat>pkcs12</CertificateFormat><Password>pwd</Password><CertificateFile>LE_cert.pfx</CertificateFile></Certificate></Set></Request>' -Method POST -body $body

This gives me the following request body:

--db611ddb-ea8a-450f-aad8-90bee1c6a889
Content-Type: application/xml; charset=utf-8
Content-Disposition: form-data; name=reqxml
<Request>
   <Login>
      <Username>apiUSER</Username>
      <Password>apiPWD</Password>
   </Login>
   <Set operation="add">
      <Certificate>
         <Name>LE_cert</Name>
         <Action>UploadCertificate</Action>
         <CertificateFormat>pkcs12</CertificateFormat>
         <Password>password1</Password>
         <CertificateFile>LE_cert.pfx</CertificateFile>
      </Certificate>
   </Set>
</Request>
--db611ddb-ea8a-450f-aad8-90bee1c6a889
Content-Disposition: form-data; filename="LE_cert.pfx"; name="LE_cert"
Content-Type: application/octet-stream
<<--redactedEncodedTXT-->>
--db611ddb-ea8a-450f-aad8-90bee1c6a889--

I think I have got my request in the same format as Trond's example but I am still getting "<Status code="500">Operation could not be performed on Entity.</Status>"

I was wondering how you were encoding your certificate, I have tried the above iso-8859-1, but also UTF-8 and Base64 and none of them have got the certificate uploaded.

I think I have got this right, but I just can't get the certificate uploaded, so any help would be greatly appreciated.

Cheers,

Tim

Hi Trond and Andrew,

Firstly, thanks for the detailed question, it has helped me get closer to uploading the cert. I think.

This is the PowerShell script that I have got so far (based a lot off this page: http://blog.majcica.com/2016/01/13/powershell-tips-and-tricks-multipartform-data-requests/)

$ContentType = "application/octet-stream"
$certFile = "C:\temp\LE_cert.pfx"
$fileName = Split-Path $certFile -leaf
$boundary = [guid]::NewGuid().ToString()
$fileBin = [System.IO.File]::ReadAllBytes($certFile)

$enc = [System.Text.Encoding]::GetEncoding("iso-8859-1")

$template = @'
   --{0}
   Content-Type: application/xml; charset=utf-8
   Content-Disposition: form-data; name=reqxml
   <Request>
      <Login>
         <Username>apiUSER</Username>
         <Password>apiPWD</Password>
      </Login>
      <Set operation="add">
         <Certificate>
            <Name>LE_tcxapi_20181105_cert</Name>
            <Action>UploadCertificate</Action>
            <CertificateFormat>pkcs12</CertificateFormat>
            <Password>pwd</Password>
            <CertificateFile>{1}</CertificateFile>
         </Certificate>
      </Set>
   </Request>
   --{0}
   Content-Disposition: form-data; filename="{1}"; name="Unique"
   Content-Type: {2}
   {3}
   --{0}--
'@

$body = $template -f $boundary, $fileName, $ContentType, $enc.GetString($fileBin)
 

$response = Invoke-WebRequest -UseBasicParsing -Headers $headers -Uri 'fw-exg-00:4444/.../APIController operation="add"><Certificate><Name>MHA_TEST_Cert</Name><Action>UploadCertificate</Action><CertificateFormat>pkcs12</CertificateFormat><Password>pwd</Password><CertificateFile>LE_cert.pfx</CertificateFile></Certificate></Set></Request>' -Method POST -body $body

This gives me the following request body:

--db611ddb-ea8a-450f-aad8-90bee1c6a889
Content-Type: application/xml; charset=utf-8
Content-Disposition: form-data; name=reqxml
<Request>
   <Login>
      <Username>apiUSER</Username>
      <Password>apiPWD</Password>
   </Login>
   <Set operation="add">
      <Certificate>
         <Name>LE_cert</Name>
         <Action>UploadCertificate</Action>
         <CertificateFormat>pkcs12</CertificateFormat>
         <Password>password1</Password>
         <CertificateFile>LE_cert.pfx</CertificateFile>
      </Certificate>
   </Set>
</Request>
--db611ddb-ea8a-450f-aad8-90bee1c6a889
Content-Disposition: form-data; filename="LE_cert.pfx"; name="LE_cert"
Content-Type: application/octet-stream
<<--redactedEncodedTXT-->>
--db611ddb-ea8a-450f-aad8-90bee1c6a889--

I think I have got my request in the same format as Trond's example but I am still getting "<Status code="500">Operation could not be performed on Entity.</Status>"

I was wondering how you were encoding your certificate, I have tried the above iso-8859-1, but also UTF-8 and Base64 and none of them have got the certificate uploaded.

I think I have got this right, but I just can't get the certificate uploaded, so any help would be greatly appreciated.

Cheers,

Tim