XERO私有应用创建失败：PEM文件生成相关问题求助

Let’s work through the kinks in your Xero private app setup—this error usually boils down to small oversights in key generation or app configuration. Here’s what to check step by step:

1. Confirm Your OpenSSL Commands Produced Valid Files #

First, make sure each command ran without errors and generated intact files:

• Private Key: Run cat privatekey.pem—it should start with -----BEGIN RSA PRIVATE KEY----- and end with the corresponding closing line. If it’s empty or throws an error, re-run openssl genrsa -out privatekey.pem 1024 (or try 2048-bit, which Xero recommends for better security).
• Public Certificate: Check publickey.cer with cat publickey.cer—it must include -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----. When you ran the req command, did you fill in all required fields? The Common Name should be relevant to your app (e.g., "My Xero Private App").
• PFX File: Verify public_privatekey.pfx exists. If you skipped setting an export password when running the pkcs12 command, try re-running it with a simple password (like "xero123")—some OpenSSL versions generate invalid files without a password.

2. Fix Xero App Setup Gotchas #

Xero has strict validation rules that are easy to miss:

• Key Length: While 1024-bit works, Xero prefers 2048-bit or higher. Regenerate your keys with openssl genrsa -out privatekey.pem 2048 and repeat the rest of the steps—this often resolves compatibility issues.
• Public Key Pasting: When uploading your public key to Xero, paste the entire content of publickey.cer, including the BEGIN/END lines. Trimming even one character will cause validation to fail.
• System Clock Sync: If your computer’s clock is off (e.g., set to a future date), the certificate’s validity period might be flagged as invalid. Sync your clock and regenerate the certificate if needed.

3. Validate Your Key Pair & Certificate #

Run these commands to confirm your files are not corrupted:

• Check private key integrity: openssl rsa -in privatekey.pem -check
• Inspect certificate details: openssl x509 -in publickey.cer -text -noout
• Verify PFX file: openssl pkcs12 -info -in public_privatekey.pfx

If any of these commands throw errors, delete all generated files and start fresh—corrupted keys are one of the most common causes of this error.

内容的提问来源于stack exchange，提问作者Vaishakh Pai