Additional Info For Step 7 - Generate a .pfx file

[Aubrius]

Even after reading through the closed issues, it took me awhile to actually do step 7 and generate a PFX. So I thought I would compile the steps I found that worked for me in case it can help anyone else.

You will need:

1. merchant_id.cer - This is the actual certificate from the Apple developer portal.
2. Apple Pay Merchant Identity XXX.p12 - This is the private key from the machine that generated the CSR. Go to your keychain, click on certificates, and expand your Merchant Identity Cert. You should see a private key, click this and export it as PKCS # 12 (.p12).
3. Private key password - The password set when creating the private key for the CSR. This is also what will be used for MerchantCertificatePassword inside the project.
4. OpenSSL - If you don't have permission to install this on your machine, it might already be somewhere like C:\Program Files\Git\usr\bin.

Step 1

The merchant_id.cer certificate from Apple is a binary encoded version (I think?). You will need to convert it to something usable for this process. This will create merchant_id_cert.pem.
x509 -inform DER -in merchant_id.cer -out merchant_id_cert.pem

Step 2

You will also need to convert the Apple Pay Merchant Identity MERCHANT NAME.p12 private key to something usable. This will create merchant_id_key.pem. NOTE: I renamed the file "Apple Pay Merchant Identity MERCHANT NAME.p12" to "merchant_id.p12" to make it easier to work with.
pkcs12 -in merchant_id.p12 -out merchant_id_key.pem -nodes -clcerts

Step 3

Finally you combine the new cert format and new private key format into a single PFX file for use with the .NET project. This will create merchant_id.pfx.
pkcs12 -export -in merchant_id_cert.pem -inkey merchant_id_key.pem -out merchant_id.pfx
It will prompt you to enter the password for the private key and then prompt you again to confirm the password.

Now you should have a .pfx file and can move on to step 8 of the readme setup guide.

[martincostello]

Yeah, it's not an easy process. I have a gist from when I had to renew my certificate that has these commands in it:

# From https://blog.aclerbois.be/blog/2020/01/09/Generates-a-pfx-for-Apple-Pay

# Generate the CSR for Apple Pay Payment Processing
openssl req -nodes -newkey rsa:2048 -sha256 -keyout certificate.key -out certificate.csr

# Upload the CSR to developer.apple.com to get the certificate

# Generate the PFX from the CSR and CER
openssl x509 -inform der -in merchant_id.cer -out certificate.pem
openssl pkcs12 -export -inkey certificate.key -in certificate.pem -out certificate.pfx

# From https://www.ryandaigle.com/a/openssl-generate-apple-pay-csr/

# Generate the CSR for Apple Pay Merchant Identity
openssl ecparam -out certificate.key -name prime256v1 -genkey
openssl req -new -sha256 -key certificate.key -nodes -out request.csr

# Generate the PFX from the CSR and CER
openssl x509 -inform der -in apple_pay.cer -out certificate.pem
openssl pkcs12 -export -inkey certificate.key -in certificate.pem -out certificate.pfx

Would you be interesting in distilling this issue into a pull request to update the instructions in the README?

[Aubrius]

Yeah, sounds good!

[KungFuCookie]

Very Helpful @martincostello thankyou.

Small issue, It seems for Payment Processing we use

openssl ecparam -out certificate.key -name prime256v1 -genkey
openssl req -new -sha256 -key certificate.key -nodes -out request.csr

And this one for Merchant Identity

openssl req -nodes -newkey rsa:2048 -sha256 -keyout certificate.key -out certificate.csr

Basically the other way around! Its actually just the 2 comments that need switched only :
'Generate the CSR for Apple Pay Payment Processing' swap with 'Generate the CSR for Apple Pay Merchant Identity'

ProcessingCert is called apple_pay.cer
MerchantCert is called merchant_id.cert

[KungFuCookie]

Another gotcha I found. When publishing and testing in Azure, (using Net6) It was not possible to complete merchant validation using the PFX cetificate without setting a mysterious config in Azure Portal , basically I was getting weird SSL connection exceptions until I set this.

We need to set this Azure WebApp config > WEBSITE_LOAD_USER_PROFILE : 1

https://stackoverflow.com/questions/54983993/aure-function-app-returns-the-credentials-supplied-to-the-package-were-not-reco

Hopefully this helps someone, somewhere. I took me best part of 6 hours to figure out this config.

[martincostello]

Thanks for pointing that out - I've added that to the Azure section in the README in #353.

[KungFuCookie]

Thankyou for sharing this repo. It was very very helpful. The ApplePay docs suck