CSR algorithm/size is incorrect.Expected RSA 2048

Question

I am trying to integrate apple pay with braintree. I have followed up the following instructions to enable apple pay in the brain tree. In the first step, if you click on certificate signing request, it downloads a braintree_app_pay.certSigningRequest file which is used in the apple membership.

When I choose to create payment process certificate, I am getting the following error.

whoever has clicked on the close button, please let me know the reason!!!! — casillas, Jun 18 '17 at 16:07
This seems like a Braintree issue. What does their tech support say about your issue? — Robotic Cat, Jun 18 '17 at 16:40
This question is off-topic because it is about third-party support for a business function, not a coding issue. Please see [Why we're not customer support for \[your favorite company\]?](http://meta.stackoverflow.com/q/255745) — jscs, Jun 18 '17 at 16:42
I was using Google chrome while uploading the signingRequest, I used Safari as recommended and it worked! — Omar HossamEldin, Dec 30 '18 at 22:15

akisoft · Answer 1 · 2021-04-29T23:49:27.897

19

complimenting what @zepp said, you need to specify when creating CRS, and you can that by following the process below

Go to Keychain Access
Click on Certificate Assistance
Click on Request Certificate from Certificate Authority (click for image)
Enter all information and click on "Let me specify key pair Information"checkbox, then click on Continue
Select KeySize to be 256 and Algorithm to be ECC (click for image)
Then click on continue.

edited Apr 29 '21 at 23:49

answered Jan 18 '18 at 13:43

akisoft

503
6
12

2

it clearly states on the documentation that you must use the CSR the Braintree provides you. – cream-corn Aug 07 '18 at 00:16
2

But Braintree said `Upload the CSR that you downloaded from Braintree in step 1. Note: You must use the CSR we provide. Do not create a CSR file yourself.` – JerryZhou Jul 26 '19 at 06:00

zepp · Answer 2 · 2017-06-19T19:53:33.707

9

_{Full disclosure: I work at Braintree. If you have any further questions, feel free to contact our Support team.}

Make sure you're selecting the Apple Pay Certificate option under Production (even if this is for a Sandbox; see the Braintree Apple Pay configuration docs for details) when choosing the type of certificate to add in the Apple Developer portal. Apple Pay CSRs should be generated with ECC, not RSA.

Here's what the CSR prompt screen should look like. Although you'll be uploading the CSR obtained from Braintree instead of generating one, note Apple's specifications for the key:

edited Jun 19 '17 at 19:53

answered Jun 19 '17 at 17:15

zepp

278
2
7

but it's said 'must use the CSR the Braintree provides you' – JerryZhou Jul 26 '19 at 05:29
i still get the same error when i tried this, as it wants algorithm RSA (2048), not ECC (256) as we can see in the picture – Stoyan Jul 29 '20 at 13:02

score 5 · Answer 3 · answered Dec 28 '18 at 06:31

Please follow below steps[If use Apple Pay with stripe or any other payment gateway]:

Double click on CSR (Downloaded from Stripe), [It will open Certificate Assistant]
Click on Continue
Select 'Request a certificate from an existing CA', and Continue
In Certificate Information screen, Enter User Email Address, Common Name, Leave CA Email Address empty, Select 'Saved to disk & checked Let me specify key pair information' [Select your specific location and save]
In Key Pair Information screen, select 'ECC' algorithm & select Key size : 256 bits and continue.

Now use this CSR in your payment processing certificate.

score 4 · Answer 4 · answered Nov 19 '18 at 12:17

This issue is not specific to Apple Pay or Braintree - I ran into the same issue when trying to create a CSR for getting a Safari certificate from Apple.

What's important to know is that you need to select the iCloud keychain before using the Request Certificate from Certificate Authority command. If you don't, another keychain may be active, causing wrong keys to be used.

score 2 · Answer 5 · answered Sep 10 '19 at 11:53

From Apple Developer Forum

Within the Keychain Access drop down menu, select Keychain Access > Certificate Assistant > Request a Certificate from a Certificate Authority.

In the Certificate Information window, enter the following information:

In the User Email Address field, enter your email address.

In the Common Name field, create a name for your private key (e.g., John Doe Dev Key).

The CA Email Address field should be left empty.

In the "Request is" group, select the "Saved to disk" option.

Select "Let me specify key pair information".

Click Continue within Keychain Access and select the file location.

Set the Key Pair Information to the following:

Algorithm: ECC

Key Size: 256 bits Click

Continue within Keychain Access to complete the CSR generating process.

JerryZhou · Answer 6 · 2019-07-26T06:26:23.240

1

I don't get it, because it's said You must use the CSR we provide. Do not create a CSR file yourself on braintree website.

And with this CSR file, it's always failed on apple's upload page.

Edit: I finally upload success with follow steps of @anjali-jariwala 's answer. Just in last step, I choose RSA & 2048 as alert requirement.

edited Jul 26 '19 at 06:26

answered Jul 26 '19 at 06:12

JerryZhou

4,566
3
37
60

score 1 · Answer 7 · answered Apr 08 '20 at 15:11

1

For me I accidentally chose Yes when asked Will payments associated with this Merchant ID be processed exclusively in China?

Choosing No solved the issue for me

answered Apr 08 '20 at 15:11

Simon Moshenko

2,028
1
15
36

score 1 · Answer 8 · answered Apr 05 '21 at 18:28

I had the same error. The mistake on my part was choosing the wrong type of certificate while creating it in the Apple developer portal. I used 'Apple Pay Merchant Identity Certificate', but I needed to use 'Apple Pay Payment Processing Certificate', which solved the issue.

CSR algorithm/size is incorrect.Expected RSA 2048

8 Answers8