Best Of

Hello @G_Hosa_Phat,

You didn't overlook this endpoint. The root cause has been reported to Engineering. The 6.5.4.8 API documentation link is redirecting to the SonicOS 7.0.1 API documentation so we were looking at the wrong information. The link I provided in my previous post correctly loads the Gen6 API documentation.

I just tested this on both Gen6 and Gen7. On the Gen6 6.5.4.8 firmware release, I am getting the same 400 Bad Request response with the "API endpoint is incomplete" message. I did some research and could not get it to work. On the Gen7 7.0.1 release, I am able to successfully export the CSR.

EDIT: I filed a report with Engineering regarding this API endpoint on 6.5.4.8.

For the step of importing the signed certificate, please take a look at this thread:

In my experience, the API follows the CLI command structure very closely, so you might find the CLI documentation and CLI help menus and auto-completion/tabbing to be helpful. I haven't actually looked at the CLI documentation for certificates, and it is my first time looking at generating a CSR using the API. Personally, when I run into an issue like that where I get syntax or schema validation errors, or "no command found" type of errors, I'll hop into an SSH or console session and follow the CLI command structure of what I'm working on. That's actually how I determined that the country needed to be "United States" and not "US".

Hi @G_Hosa_Phat,

I tested this out and have a solution for you. Check out the items below and the correct JSON to use.

1. The country name (not abbreviation) is expected. It will fail if the country name isn't in the list of expected names. The API is very similar to the CLI so sometimes the CLI can provide hints where the Swagger documentation does not.
2. Don't include the elements that will be null. Notice the JSON below does not include the optional SAN, or the last two configurable elements of the CSR.
3. The signature algorithm expects "md5", "sha-1", "sha-256", "sha-384", or "sha-512". The POST will fail if the signature algorithm is not one of the expected strings.

Please use the following JSON in your POST:

{
    "certificates": {
        "generate_signing_request": [
            {
                "alias": "test_csr",
                "distinguished_name": {
                    "element1": {
                        "country": "United States"
                    },
                    "element2": {
                        "state": "StateName"
                    },
                    "element3": {
                        "locality": "City Name"
                    },
                    "element4": {
                        "organization": "My Company Name"
                    },
                    "element5": {
                        "department": "Information Services"
                    },
                    "element6": {
                        "common_name": "test.mydomain.com"
                    }
                },
                "signature_algorithm": "sha-256",
                "key": {
                    "type": "rsa",
                    "size": "2048"
                },
                "generate": true
            }
        ]
    }
}