topic RE: API call with .PEM and .KEY file in Product Forum

API call with .PEM and .KEY file

VarunVeetil — Fri, 11 Jun 2021 13:07:00 GMT

Hi All,

I was wondering if anyone could provide some guidance on this scenario

The API gateway that I need to hit requires .PEM .KEY authentication. I am trying to incorporate that into blueprism and was wondering if there is any additional setup we can do on the web API services to incorporate the .PEM and .KEY ?

PEM, KEY and the query is correct as I am able to make a successful call via postman.

We also tried using the Certificate thumbprint using the "C:\Program Files\Blue Prism Limited\Blue Prism Automate\automate.exe" /resourcepc /public /port 8181 /sslcert command but getting the below error
Listener failed : Unable to find the requested SSL certificate - ensure that it is installed in the local certificate store and is valid.

TIA

------------------------------
Varun Veetil
------------------------------

RE: API call with .PEM and .KEY file

ewilson — Fri, 11 Jun 2021 18:48:00 GMT

@Varun Veetil,

The Web API service feature of Blue Prism does not support client certificate authentication. The only options are HTTP Basic, Bearer Token, and OAuth2 Client and JWT. If you need to provide certificate details you'll need to switch to using the HTTP VBO or direct code stages.

Cheers,

------------------------------
Eric Wilson
Director, Partner Integrations for Digital Exchange
Blue Prism
------------------------------

RE: API call with .PEM and .KEY file

VarunVeetil — Thu, 01 Jul 2021 02:24:00 GMT

Hi Eric,

Thanks for your response.

Would you know how can I pass the .Key and .Pem through the HTTP VBO and in which format does the headers be specified in the collection?

Thank you
Varun

------------------------------
Varun Veetil
------------------------------

RE: API call with .PEM and .KEY file

ewilson — Thu, 01 Jul 2021 15:02:00 GMT

@Varun Veetil,

There is an action on the HTTP VBO called Load Certificate that can be used for loading an X.509 certificate into memory for the VBO to use. It will return an ID if the certificate is successfully loaded. You then pass that ID into your call to the HTTP Request or HTTP Request File actions.

Cheers,

------------------------------
Eric Wilson
Director, Partner Integrations for Digital Exchange
Blue Prism
------------------------------

RE: API call with .PEM and .KEY file

VarunVeetil — Fri, 02 Jul 2021 05:51:00 GMT

Thanks Eric.
Could you also give me the format in which the header collection needs to be in?

I have 5 headers that I need to pass which I tired by creating 2 columns "Key" & "Value", but doesn't seem to work.

Currently, I am getting a 403 without the headers and would like to believe its just to do with the headers and the cert is good.

Thank you
Varun

------------------------------
Varun Veetil
------------------------------

RE: API call with .PEM and .KEY file

ewilson — Fri, 02 Jul 2021 14:39:00 GMT

There is no required name for the columns. If you look at the Code stage within the HTTP VBO for the HTTP Request you'll see the logic that deals with the Headers Collection. The code pulls the column name, whatever it is, from the Column definition within the DataTable. It then uses that value to access the actual data in the rows.

Cheers,

------------------------------
Eric Wilson
Director, Partner Integrations for Digital Exchange
Blue Prism
------------------------------

RE: API call with .PEM and .KEY file

ewilson — Fri, 02 Jul 2021 14:40:00 GMT

You can verify that your headers are being set by using a tool like Fiddler to capture the actual network request.

Cheers,

------------------------------
Eric Wilson
Director, Partner Integrations for Digital Exchange
Blue Prism
------------------------------

RE: API call with .PEM and .KEY file

Dominika.Zolotarew — Fri, 21 Jul 2023 13:50:00 GMT

Hello Eric,
Provider of the service expects call that in cURL looks like this:

curl -k -X GET "https://urlfake.json" --key "C:\Desktop\decrypted_private_key.pem" --cert "C:\Desktop\public_cert.pem"

So I need to provide public certificate and the private rsa key separately in PEM format.

"Load Certificate" action from the VBO only gives me possibility to load one of these files and then I can provide only one Certificate ID in the next callas.
Any solution for that?

------------------------------
Dominika Zolotarew
------------------------------

RE: API call with .PEM and .KEY file

ewilson — Mon, 24 Jul 2023 13:32:00 GMT

Hello @Dominika.Zolotarew,

As far as I know, Microsoft has only added direct support for PEM certificates in .NET Core. Blue Prism uses the .NET Framework though, and in the .NET Framework class used by the Utility - HTTP VBO, only PKCS12 certificates are supported. So you would need to convert you PEM certificate to the PKCS12 format.

If you're able to interact with the service via cUrl, you could use the Utility - Environment VBO to execute your cUrl command from a command prompt and then receive the response output.

Cheers,

------------------------------
Eric Wilson
Director, Integrations and Enablement
Blue Prism Digital Exchange
------------------------------

RE: API call with .PEM and .KEY file

Dominika.Zolotarew — Tue, 25 Jul 2023 12:39:00 GMT

Hello Eric,
Thank you for your response.

Yes, I have tried to utilize cmd, however, I cannot go past this error "curl: (58) schannel: Failed to import cert file C:\Desktop\public_cert.pem, last error is 0x80092002". It seems it can be resolved by downgrading the cURL, but it might not be possible in our workspace

------------------------------
Dominika Zolotarew
------------------------------

RE: API call with .PEM and .KEY file

ewilson — Tue, 25 Jul 2023 14:41:00 GMT

@Dominika.Zolotarew,

If you try running the curl command yourself do you receive the same error, or is it just when the digital worker tries to do it? There's an optional command line parameter for curl called --cert-type I believe. You might try adding that to your command line as --cert-type PEM and see if that makes any difference.

Cheers,

------------------------------
Eric Wilson
Director, Integrations and Enablement
Blue Prism Digital Exchange
------------------------------

RE: API call with .PEM and .KEY file

Dominika.Zolotarew — Wed, 26 Jul 2023 08:44:00 GMT

Hello Eric:)
Thank you again for the reply.
I trying to make it work in cmd directly for now.

After quick search I am not sure how to utilize --cert-type PEM. People doesnt seem to use it. I think PEM is a default format for cURL.

curl -k -X GET "https://urlfake.json" --key "C:\Desktop\decrypted_private_key.pem" --cert "C:\Desktop\public_cert.pem" --cert-type PEM

But I probably used it incorrectly since I have errors: curl: (58) schannel: certificate format compatibility error and curl: (3) URL using bad/illegal format or missing URL.

Going back to my initial question.
I found that this service can accept .p12 but they are again two of them - 'keystore' and 'truststore' so I am not sure how to work with it in Utility - Http.

------------------------------
Dominika Zolotarew
------------------------------

RE: API call with .PEM and .KEY file

ewilson — Wed, 26 Jul 2023 16:44:00 GMT

@Dominika.Zolotarew,

I believe on Windows, cUrl defaults to looking for certificates in the standard Windows keystore. If you have a .p12 version of your certificate you could use the Windows Certificate Manager plugin to install it into the store and then try cUrl again.

The purpose of the --cert-type flag is to instruct cUrl that you specifically want to use a PEM-based certificate. If my assumption about cUrl on Windows is correct, this is how you would override the default behavior. You might try adding the --cert-type flag before the other certificate parameters. Example:

curl -k -X GET "https://urlfake.json" --cert-type PEM --cert "C:\Desktop\public_cert.pem" --key "C:\Desktop\decrypted_private_key.pem"

Regarding the cUrl error you're seeing, did you generate this PEM file yourself or was it supplied to you by your IT team? Does the private key file have a passphrase associated with it?

One other thing. I'm not sure that it will make a difference, but every time I've dealt with a key file it has had .key as the file extension instead of .pem. The certificate file should have .pem. So, you might try changing that file extension too.

Cheers,

------------------------------
Eric Wilson
Director, Integrations and Enablement
Blue Prism Digital Exchange
------------------------------

RE: API call with .PEM and .KEY file

Dominika.Zolotarew — Thu, 27 Jul 2023 07:15:00 GMT

Hello Eric,
There is the same error when I put the flag and the cert before other parameters unfortunately, however, only one since "(3) URL using bad/illegal format or missing URL." disappeared.

I for now use certificates provided by the IT. It has a passphrase, yes.

Sorry, my intention was not clear. What I meant is:
In the materials the service provider given me I see that in one of the possible ways to authenticate .p12 was used (please see piece of the code). However, in form of 2 files at least (keystore.p12 and truststore.p12). So I would like to to utilize "Utility - Http" since certificate format is .p12 as expected. However, I am not sure if its possible since it seems I need to provide it as 2 separate files.

(...)host='fake.net',
port=XXXX,
keystore_path="C:\Desktop\keystore.p12",
truststore_path="C:\Desktop\truststore.p12",
keystore_password=open(C:\Desktop\.keystore.pw').read(),
truststore_password=open(C:\Desktop\.truststore.pw').read()(...)

------------------------------
Dominika Zolotarew
------------------------------

RE: API call with .PEM and .KEY file

Dominika.Zolotarew — Thu, 10 Aug 2023 13:34:00 GMT

Hello Eric,
FYI.
We bypassed the problem by indicating cmd to use curl.exe belonging to the GitHub dir,

------------------------------
Dominika Zolotarew
------------------------------