account:setup:ci Certificate Conditions documentation generates unusable certificates

[nemchik]

Select the SuiteCloud tool where you encountered the issue

SuiteCloud CLI

Version of the SuiteCloud Tool

"@oracle/suitecloud-cli": "3.1.2"

Operating system

Windows 11 25H2 with WSL Ubuntu 24.04.4 LTS

Node Version / VSCode Version

v24.14.0 (v22.22.1 was also tested, both versions are LTS)

JAVA Version

java 21.0.10+8-LTS-217

Bug description

The documentation for account:setup:ci links to Certificate Conditions which supplies commands for creating certificates as follows:

ES256

openssl req -new -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -pkeyopt ec_param_enc:named_curve -nodes -days 365 -out public.pem -keyout private.pem

ES512

openssl req -new -x509 -newkey ec -pkeyopt ec_paramgen_curve:secp521r1 -pkeyopt ec_param_enc:named_curve -nodes -days 365 -out public.pem -keyout private.pem

RSA - PSS

openssl req -new -x509 -newkey rsa:4096 -keyout private.pem -sigopt rsa_padding_mode:pss -sha256 -sigopt rsa_pss_saltlen:64 -out public.pem -nodes -days 365

However, attempting to use certificates generated with these options results in an error message:

There was an error with the private key used to authenticate. Verify the contents of the private key.

I have tried using Win64 OpenSSL v3.6.1 Light as well as the openssl command in Ubuntu 24.04.4 LTS via WSL. I have confirmed that line endings (CRLF/LF) and trailing newlines in the file being present or not does not affect the outcome.

I have tested this in GitHub Actions and locally via WSL, and I have set SUITECLOUD_CI=1 and SUITECLOUD_CI_PASSKEY=a_32_to_100_character_string in both environments with the same result.

Steps To Reproduce

1. Generate a certificate with one of the 3 commands above (per the documentation)
2. Upload the public key in the OAuth 2.0 Client Credentials Setup by choosing SuiteCloud Development Integration in the Application field and selecting the entity and role to map
3. Note the Certificate ID to be used
4. Run suitecloud account:setup:ci --account <myAccountId> --authid <myAuthId> --certificateid <myCertificateId> --privatekeypath private.pem
5. Receive the error message

   There was an error with the private key used to authenticate. Verify the contents of the private key.

Actual Output

There was an error with the private key used to authenticate. Verify the contents of the private key.

Expected Output

The authentication was successful with the following account and role: <myCompany> [<myOAuthRole>]. This project will use the authentication ID "<myAccountId>" as default.
The account has been successfully set up.

Ideally to resolve the issue, the documentation for Certificate Conditions should be updated to provide example commands that do not cause this issue.

Anything else?

Using the following command to generate a certificate works without issue:

openssl req -x509 -newkey rsa:4096 -sha256 -keyout private.pem -out public.pem -noenc

Ref: #834 (comment)

[davidecorreu]

Hi @nemchik, thanks for the detailed report.

For suitecloud account:setup:ci, the SuiteCloud CLI documentation explicitly states that the certificate must be RSA. The linked NetSuite Certificate Conditions page is general NetSuite guidance for multiple integration scenarios, so it includes other schemes (e.g., EC/ES256/ES512, RSA-PSS), but those are not necessarily applicable to the SuiteCloud SDK / SuiteCloud Development Integration flow used by the CLI.

• SuiteCloud CLI (account:setup:ci) docs: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_81134826821.html#subsect_0723043038
• Check the Important information block at the end of Options section

I also tested suitecloud account:setup:ci using an RSA certificate generated with the official documentation command below, and authentication worked successfully (feel free to verify on your side):

openssl req -new -x509 -newkey rsa:4096 -keyout private.pem -sigopt rsa_padding_mode:pss -sha256 -sigopt rsa_pss_saltlen:64 -out public.pem -nodes -days 365

Other RSA-based variations—such as the RSA command you shared in your report—may also work, as long as the certificate is RSA.

[nemchik]

Hi @davidecorreu , Thanks for the response.

I missed the note about RSA being the requirement. I know I tried the ES512 option, and I thought I had tried the RSA option and had the same results, but I tried the documented RSA command again just now and did not have issues.

I guess this can be closed.

If there is anything to be done here, maybe having the suitecloud CLI explicitly output that the cert type attempting to be used is not RSA, and only RSA is supported. The error output is a little vague currently.