Upload Certificate using API

Question

Hi folks,

I've started having a play around with XG. I have a PowerShell script for generating a new Let's Encrypt certificate and updating my various components that use it, and wanted to integrate this with XG Home. It looks like the obvious way of achieving this should be the API, but I'm struggling a little with the certificate upload.

I've taken a look at the documentation and fired off a few API calls successfully, but the upload operation is a little different as it references data in a multipart request.
I'm using the v16.5 documentation because the v17 docs appear to be missing this particular page (it appears in the menu but the link is broken because the AddCertificate&UpdateCertificate.html file is missing).

I am not a developer but I did a bit of Googling and have come up with what I think is a multipart request. A Fiddler trace shows this when I fire off my request (PFX file data redacted and passwords changed).

POST sophos:4444/.../APIController
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.16299.251
Content-Type: multipart/mixed; boundary=Certificate_File_Upload
Host: sophos:4444
Content-Length: 2712
Connection: Keep-Alive

--Certificate_File_Upload
Content-Disposition: attachment; filename="test.pfx"
Content-Type: application/x-pkcs12

<<<<Encoded PFX data here>>>>
--Certificate_File_Upload--

Tidying that up for readability the decoded XML in the URL is:
<Request>
<Login>
    <Username>admin</Username>
    <Password>MyPassword</Password>
</Login>
<Set operation="add">
    <Certificate>
      <Action>UploadCertificate</Action>
      <Name>Test</Name>
      <Password>PfxPassword</Password>
      <CertificateFormat>pkcs12</CertificateFormat>
      <CertificateFile>test.pfx</CertificateFile>
      <PrivateKeyFile></PrivateKeyFile>
    </Certificate>
</Set>
</Request>

The response I get from the API is: <Status code="510">Operation failed. Deleting entity referred by another entity.</Status>

Going by the documentation this means "Certificate could not be uploaded due to invalid private key or passphrase. Choose a proper key".

I've also tried a version with the certificate and key in PEM format rather than PFX and get: <Status code="500">Operation could not be performed on Entity.</Status>
Going by the documentation this means "Certificate could not be updated".

I tried a multipart/form-data request initially, but the API didn't provide any feedback - I got an HTTP 200 response, but no XML in the body. The multipart/mixed version at least responds with some XML so I'm assuming that's what it wants.

I'm assuming there's something wrong with the way I'm uploading the PFX file - perhaps I've misunderstood what the multipart request should look like? I couldn't find an example in the docs. The encoded PFX file data looks correct though, because it appears to be the same in Fiddler when I upload the PFX via the web UI (successfully). I was hoping one of you might have tried this and could point me in the right direction, please?

Thanks,
Andrew

This thread was automatically locked due to age.

Trond Aarskog · Accepted Answer

Hi Andrew, Looks like you are close to a working solution. I too - just as you have tried - create a multipart/form-data object (System.Net.Http.MultipartFormDataContent). My request looks something like the following (highlighted in yellow where I believe you need to adjust): --6332ebe1-9b29-49f6-a4f2-1728b60e4131 Content-Type: application/xml; charset=utf-8 Content-Disposition: form-data; name=reqxml *** USER *** *** HASHED PASSWORD - remove encrypt to use non-hashed *** *** CERT NAME *** UploadCertificate pkcs12 *** PASSWORD *** *** CERT NAME *** .pfx --6332ebe1-9b29-49f6-a4f2-1728b60e4131 Content-Disposition: form-data ; filename= *** CERT NAME *** .pfx; name= *** CERT NAME *** Content-Type: application/octet-stream *** BINARY DATA *** --6332ebe1-9b29-49f6-a4f2-1728b60e4131-- With this approach I get the following response: Authentication Successful Configuration applied successfully. Also remember that you cannot upload a certificate with a name that already exists. You need to create a new unique name each time (then update all references to use the new and then delete the old). A final note here is that it seems that firewall rules that have Path-specific routing looses some of its configuration on update (in my case the Allowed Client Networks ). Haven't fully investigated what I'm doing wrong here, but to me it seems to be a bug in the API as I on update return the same configuration the API gives me... Hope this helps! Trond

JamieBah1 · Answer

curl -k -F "reqxml=:4444/webconsole/APIController?" What mattered was using the @ and not < for the "file=" section. From the Curl man page: The difference between @ and < is then that @ makes a file get attached in the post as a file upload, while the < makes a text field and just get the contents for that text field from a file. The rest of this post is for those still learning/trying to figure things out: ---Contents of the file called uploadTest.txt--- username password UploadCertificate friendly name for us humans goes here password to decrypt the certificate file pkcs12 Certificates.p12 ---End content of file uploadTest.txt--- **In the example above, Certificates.p12 is a placeholder for the filename of your certificate, and if you don't have a separate private key file you can omit the PrivateKeyFile line. I created a .p12 file for my certificate and private key simply because it was less to type in the file above and command line when testing. Valid formats are listed in the API documentation