X509 Certificate Request

Question

I got X509 certificate (single .cer file), I can decode , so no problem with that. Now I want to sign a request with this certificate in node, but I cannot get this to work:

var https = require("https"); var fs = require("fs"); var options = { host: 'management.core.windows.net', path: '/my-subscription-id/services/hostedservices', port: 443, method: 'GET', cert: fs.readFileSync("./SSLDevCert.cer"), agent: false }; var req = https.request(options, function(res) { console.log("statusCode: ", res.statusCode); console.log("headers: ", res.headers); res.on('data', function(d) { process.stdout.write(d); }); }); 

This does not work with

Error: Error: 0906D06C: PEM routines: PEM_read_bio: No start line
in Object.createCredentials (crypto.js: 72: 31)
in Object.connect (tls.js: 857: 27)
on Agent._getConnection (https.js: 61:15)
on Agent._establishNewConnection (http.js: 1183: 21)

Doing the same in C # works fine:

 var req = (HttpWebRequest)WebRequest.Create(string.Format("https://management.core.windows.net/{0}/services/hostedservices", "my-subscription-id")); req.ClientCertificates.Add(new X509Certificate2(File.ReadAllBytes("./SSLDevCert.cer")); var resp = req.GetResponse(); 

Answer 1

Keep track of this:

Only a .cer file probably means that the private key is in the certificate (well, what is the case with Azure certificates), you will have to convert it to a PEM file (which starts with ----BEGIN RSA PRIVATE KEY---- ), and then run the query with:

 var key = fs.readFileSync("./key.pem"); var options = { cert: key, key: key } 

Retrieving a private key from a file can be a bit complicated, but it worked on Azure certificates, so it can help any of you:

 openssl pkcs12 -in ' + file + ' -nodes -passin pass: 

(note the empty pass argument)

Answer 2

PEM_read_bio expects a certificate in PEM format, while you have a certificate in raw DER format. Obviously, you need to convert your certificate to PEM format.

BTW.cer files in DER format do not contain a private key and cannot be used for signing.

You need to double-check what you have in your .cer file and in what format.