client cert creation ACM PCA issue-certificate vs AWS IoT issue create-certificate-from-csr

Goal : Create client certificate based on CSR request

Our device is capable of generating a self signed cert and can returns CSR for the certificate in base64 encoded DER blob.

• Ref: https://www.rfc-editor.org/rfc/rfc5967.html#section-2.2

With CSR (base64 encoded DER blob) we are able to successfully generate the client certificate using AWS IoT API as below and use to connect to AWS MQTT test client

aws iot create-certificate-from-csr --certificate-signing-request=file://certificate.csr

But if we use the same CSR (base64 encoded DER blob) AWS ACM PCA API as below, we get a CSR validation error

aws acm-pca issue-certificate --certificate-authority-arn “arn:aws:acm-pca:us-east-...” --csr file://certificate.csr --signing-algorithm SHA384WITHECDSA --template-arn arn:aws:acm-pca:::template/EndEntityCertificate/V1 --validity Value=9,Type="YEARS" --idempotency-token 1234

From my understanding, AWS ACM PCA, in issue-certificate API call, expects the CSR to be in https://www.rfc-editor.org/rfc/rfc7468#section-7 format

• Why is there such a difference between AWS own services?
• What's the standard and recommended way so that we do not have 2 different formats across services?
• Is there any configuration on AWS IoT/PCA services to make them respond similarly?