how to generate a correct .pem file based on merchant identity certificate .cer file ?

I'm unable to generate correct .pem file for initiate a payment session with apple pay server. I've got the error : "PEM routines:get_name:no start line"

const cert = fs.readFileSync('certs/apple-pay/apple_pay_crt.pem', 'utf8');
const key = fs.readFileSync('certs/apple-pay/apple_pay_key.pem', 'utf8');
const url = (req.params.validationUrl) ? decodeURIComponent(req.params.validationUrl) : 'https://' + endpointDomain + endpointPath;
const options = {
  cert: cert,
  key: key,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  }
}

return await new Promise(resolve => {
  let data = '';
  let req = https.request(url, options, (res) => {
    res.setEncoding('utf8');
    res.on('data', (d) => {
      resolve(d);
    });
    res.on('error', () => {
      resolve()
    });
    res.on('close', () => {
      resolve(data);
    })
  });
  req.write(JSON.stringify(body));
  req.end();
});

i added the .cer in keyChains tool, export it in .p12 format and convert it in .pem with command below :

openssl pkcs12 -in apple_pay.p12 -out apple_pay_crt.pem -clcerts -nokeys
openssl pkcs12 -in apple_pay.p12 -out apple_pay_key.pem -nocerts
Answered by Systems Engineer in 691407022

Okay, well sometimes it is the case that your private key and certificate are in the correct format, but your server side APIs do not handle them properly. Now, I cannot help with your server side code, but I can provide you a way to check whether you Merchant Identity assets are correct, and that is by using CURL to perform client authentication instead. If you are able to do this successfully, then you know you have an issue with the way your server side APIs are using the Merchant Identity assets.

For more on how to use CURL to request a payment session see the Apple Pay on the Web Debugging guide.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
Accepted Answer

Okay, well sometimes it is the case that your private key and certificate are in the correct format, but your server side APIs do not handle them properly. Now, I cannot help with your server side code, but I can provide you a way to check whether you Merchant Identity assets are correct, and that is by using CURL to perform client authentication instead. If you are able to do this successfully, then you know you have an issue with the way your server side APIs are using the Merchant Identity assets.

For more on how to use CURL to request a payment session see the Apple Pay on the Web Debugging guide.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

Thank's Matt for the reply. For those who are stuck on this kind of issue : the right command for convert .p12 in .pem is

openssl pkcs12 -in apple_pay.p12 -out apple-pay-cert.pem -nodes -clcerts

key file is not needed

make sure to use openssl v2 or lower to avoid an error similiar to: Error outputting keys and certificates 100000000A000000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c

how to generate a correct .pem file based on merchant identity certificate .cer file ?
 
 
Q