ACM PCA - CSR is missing required element 'attributes'

Question

Hello,  
  
I am using this API using .NET SDK:  
https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_IssueCertificate.html  
  
and getting an error:  
ACM PCA - CSR is missing required element 'attributes'  
  
Here is the CSR:  
-----BEGIN CERTIFICATE REQUEST-----  
MIICVjCCAT4CAQAwEzERMA8GA1UEAwwIZGV2aWNlMDUwggEiMA0GCSqGSIb3DQEB  
AQUAA4IBDwAwggEKAoIBAQCa80T77IAd6Dlbfx2CK6tawmYXq+1XhvdNYOk2B7aY  
NtFyCYSU_ZWGIpVPbea2dWSMfMO_ceUW9g7ikY3PSvkedsWpR2s8p2q4zmqTPv/t  
/b77AplVTtKvWdySXFcJ/NZCum4ScGgpehZFPytP8M+bw163BOjCjbTQPkrXjnte  
4Bxjp8rddg1pzegrAyF/64GKOhoo9mw2upplkGPv9zFGMfT+jU3nGGaL8iXeYhYb  
nFpYpL9TIBTcfAbj51gVIxyJfc7avV2pXBG2DOpGppOz5fXXiI8GodOu6PNyNqE4  
Trmk5k3TUZMLfco+XtCHLhQ8IeeelrJVqjPquVpEAUCdAgMBAAEwDQYJKoZIhvcN  
AQELBQADggEBABVqpmkKkafGeNPW6mMqEBY6bdLVebJ1Rb1b4zP3BLebgbxnFTnS  
eXb4MCzS4i+cwkrpjTXZ5oo8VThtvgDRrI8Wv0UzIUaMwZNL97IoGKtt9uJvUXtX  
DGtHNB9n06Rd83CfPAE7tiwiCiPo8zxqfzqy75eaEy9JdgznVeG8VyR/ZC4232iR  
q09m0fIjTI1AYJlJKuC7yjobYQQKXWUqz1Q3Npa_ui8n_e25R0ZrPkN+K8bxeNsI  
su/gqYV0SbhJ5Y4mgBsO3Qdbiww8ohO8dsFHUTimhzQi5OVj3sQ9NlHpsj+KrJNT  
rmDQemLyw7d3V338Jf7AaHcPYnubkY3fXWk=  
-----END CERTIFICATE REQUEST-----  
  
it is generated by C# BouncyCastle. This CSR works fine with other CAs like Windows CAs and EJBCA.  
  
Could you please help take a look and let me know what the issue can be?  
  
Thanks  
Thanh

Accepted Answer

I believe 'attributes' refers to the fields that specify the purpose of the certificate, such as basicConstraints, keyUsage, and/or extendedKeyUsage. Your CSR does not contain any of those, which you can see using a decoder tool like  . I suggest adding a value for either keyUsage or extendedKeyUsage at a minimum.

ACM PCA - CSR is missing required element 'attributes'

Relevant content