Description

The CLI permits the use of a certificate ID that contains a dot (.); however, the generation of a certificate will fail with the following error message:

error: Failed to encode the certificate request in PKCS-10 format.
But if you use a name without a dot, everything works as expected.

Symptoms

Example :
> request security pki generate-key-pair certificate-id test.name size 1024
Generated key pair test.name, key size 1024 bits

Now, when you try to generate a CSR:
> request security pki generate-certificate-request certificate-id test.name domain-name vpn1.rappaport.at subject "CN=vpn1.rappaport.at,OU=Lab,O=Juniper,L=Wien,ST=Wien,C=AT_
error: Failed to encode the certificate request in PKCS-10 format

However if you use something else other than a dot, such as a dash(-):
> request security pki generate-key-pair certificate-id test-name size 1024
Generated key pair test-name, key size 1024 bits

> request security pki generate-certificate-request certificate-id test-name domain-name vpn1.rappaport.at subject "CN=vpn1.rappaport.at,OU=Lab,O=Juniper,L=Wien,ST=Wien,C=AT_

Generated certificate request
-----BEGIN CERTIFICATE REQUEST-----
MIIB1jCCAT8CAQAwZzEaMBgGA1UEAxMRdnBuMS5yYXBwYXBvcnQuYXQxDDAKBgNV
BAsTA0xhYjEQMA4GA1UEChMHSnVuaXBlcjENMAsGA1UEBxMEV2llbjENMAsGA1UE
CBMEV2llbjELMAkGA1UEBhMCQVQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGB
ALm+XvsqAXhWsp81ZSqJj8uqt8WS+0Qdse5ef6UoHBaKt6+a8f+jVQgbVAxkgrxm
vLDK/w6UOVnYwe13OevQ2foc2wZLyt9bMrci7tq3TTTTp1wN5vEzKPRqjNTPNRbl
ixtj7pcnuOKbxoeaxENjXYT14hV3AJWH1hXsSn7lrCNHAgMBAAGgLzAtBgkqhkiG
9w0BCQ4xIDAeMBwGA1UdEQQVMBOCEXZwbjEucmFwcGFwb3J0LmF0MA0GCSqGSIb3
DQEBBQUAA4GBAI5lHabH3o72PTA9XF2Jmb5qTmELOu+0S2kEyXv4oOM0QlmSFVPB
Yun2ynwMW9hDcIzD0Qaq/5TzZC7XFV9ZsvXr4Ae5ygRS+14REN9b9t4bMBoDmz3D
JndDJRiGZVID+USoT+zI24CN6+m+/cCtgKuETR6Jjp6gG+nrQi5N+Q0R
-----END CERTIFICATE REQUEST-----
Fingerprint:
c5:f2:08:33:e1:13:89:bd:c7:e2:d0:62:9c:b9:b5:ff:11:ed:83:7d (sha1)
50:0e:47:a4:7d:f2:53:cf:c7:b1:a2:b0:a2:5d:01:3e (md5)

Solution

The cert id is stored as a file (for example, ms-cert1.cert); so it will not allow to create with a dot (.):

root@% cd /var/db/certs/common/local
root@% ls -tl
total 4
-rw-r--r-- 1 root wheel 1324 Aug 18 14:44 ms-cert1.cert
root@%


This is an expected behavior and the dot operator should not be used in the cert-id.