PSD2 service provider conecting issues (sandbox)

New-Pink-Lion-2906228819

Hello,
found several issues with the PSD2 service provider connecting.
The first one:

Performed installation call
Performed payment-service-provider-credential call
Tried to perform a device-server call using the script:
` #!/usr/bin/env bash
request='{
"description": "Token test app",
"secret": "here was an API KEY from the generated sandbox user's API KEYS"
}'

installationToken="here was an token value from the installation response"

signature=$(printf "$request" | openssl dgst -sha256 -sign ./qseal.key | openssl base64 -A)

curl -v -X POST "https://public-api.sandbox.bunq.com/v1/device-server" \
-H "User-Agent: curl" \
-H "Cache-Control: no-cache" \
-H "Content-Type: application/json" \
-H "X-Bunq-Client-Authentication: $installationToken" \
-H "X-Bunq-Client-Signature: $signature" \
-d "$request"`

but was an insufficient authentication exception:
{"Error":[{"error_description":"Insufficient authentication.","error_description_translated":"Insufficient authentication."}]}

I think the root case of the issue is the expiration of the token from the step 2 and if so there is no way to perform step 2 again or no way to refresh old token. And in the same time certificate was registered and I cannot revoke or delete registration.
So how can I proceed the connecting in this case?

The second issue.

Generated test certificate with the key
Performed installation call
Tried to perform payment-service-provider-credential call with the script:
`#!/usr/bin/env bash

installationToken="35adfe9f5b8605e0b9b95853c68686a27e99276eb4292a844f12857e09085e05"

request="{
\"client_payment_service_provider_certificate\": \"-----BEGIN CERTIFICATE-----\nMIIDJjCCAg6gAwIBAgIJANoEqOYvzRgZMA0GCSqGSIb3DQEBCwUAMCgxGTAXBgNV\nBAMMEE15IEFwcCBQSVNQIEFJU1AxCzAJBgNVBAYTAk5MMB4XDTIxMDEwNjA5NDMx\nNFoXDTIyMDEwNjA5NDMxNFowKDEZMBcGA1UEAwwQTXkgQXBwIFBJU1AgQUlTUDEL\nMAkGA1UEBhMCTkwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCxNm06\nEsQFGUSC+nRFjBiiXEv2lFxtOg6nRYHJj2pSLENg6LtyYO7qAW+3JSWGg9bZ6wqJ\n/E3Djm9fpJvqWP3DPj1fEWDS5YEtN9fF+s2+ZXCt7lEvUWuDtebpS3sLnbGvr2Ix\niwWv6oEDpd5m6QwiPWnQz/aZ56b8VDrfGLE61aaviufhLWkKxM+73kFBL8vHDK4q\nvBo9wGpIgUnQBYx7rMWJSvPZTWqghOYDCYhbWL9qJs6X+O1ggDyB6iuZMndqbTpY\nuku11zyIOrbDdKYX+0spbg1YUluQP2vf+MIgb+QFMhSW8UVt535bjGLsxelQm1zh\nJ3fxygh0VZwStyJtAgMBAAGjUzBRMB0GA1UdDgQWBBTgO3kwyGpLgIxhWf1g1kQx\npqR5JTAfBgNVHSMEGDAWgBTgO3kwyGpLgIxhWf1g1kQxpqR5JTAPBgNVHRMBAf8E\nBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCfGjQp6i8cA5B2dSTApTJz6u5hbj8i\nHJWk27+ssr0D+Gaap04mHsJQHLszlUObBJEsMyCS6hE9DQ+cklJvaSJiAGlke5co\nCD04dCPQAZgr+iL0gYJsH6nekodbLMTva8fEzh199DkusAzF3xWXc6wdJ51KQ1p9\n6qz0Ey3Xxcmj2386UwNQE75Wx37aoXivHPG7G/tv49HNQ2BQ5sWybltNVtOceC2S\nn8KbSty/vRM5uRpKCL8hY/BM+wM5DligVQJ7CnX/Saong88VHsMPSjEh2BHhuDHf\nbX0Lo9toNwlCgmkXaw9+/+gJh8xB+d24GQ9CvFLFnDR6d3jqEtvumqv2\n-----END CERTIFICATE-----\",
\"client_payment_service_provider_certificate_chain\": \"-----BEGIN CERTIFICATE-----\nMIIDJjCCAg6gAwIBAgIJANoEqOYvzRgZMA0GCSqGSIb3DQEBCwUAMCgxGTAXBgNV\nBAMMEE15IEFwcCBQSVNQIEFJU1AxCzAJBgNVBAYTAk5MMB4XDTIxMDEwNjA5NDMx\nNFoXDTIyMDEwNjA5NDMxNFowKDEZMBcGA1UEAwwQTXkgQXBwIFBJU1AgQUlTUDEL\nMAkGA1UEBhMCTkwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCxNm06\nEsQFGUSC+nRFjBiiXEv2lFxtOg6nRYHJj2pSLENg6LtyYO7qAW+3JSWGg9bZ6wqJ\n/E3Djm9fpJvqWP3DPj1fEWDS5YEtN9fF+s2+ZXCt7lEvUWuDtebpS3sLnbGvr2Ix\niwWv6oEDpd5m6QwiPWnQz/aZ56b8VDrfGLE61aaviufhLWkKxM+73kFBL8vHDK4q\nvBo9wGpIgUnQBYx7rMWJSvPZTWqghOYDCYhbWL9qJs6X+O1ggDyB6iuZMndqbTpY\nuku11zyIOrbDdKYX+0spbg1YUluQP2vf+MIgb+QFMhSW8UVt535bjGLsxelQm1zh\nJ3fxygh0VZwStyJtAgMBAAGjUzBRMB0GA1UdDgQWBBTgO3kwyGpLgIxhWf1g1kQx\npqR5JTAfBgNVHSMEGDAWgBTgO3kwyGpLgIxhWf1g1kQxpqR5JTAPBgNVHRMBAf8E\nBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCfGjQp6i8cA5B2dSTApTJz6u5hbj8i\nHJWk27+ssr0D+Gaap04mHsJQHLszlUObBJEsMyCS6hE9DQ+cklJvaSJiAGlke5co\nCD04dCPQAZgr+iL0gYJsH6nekodbLMTva8fEzh199DkusAzF3xWXc6wdJ51KQ1p9\n6qz0Ey3Xxcmj2386UwNQE75Wx37aoXivHPG7G/tv49HNQ2BQ5sWybltNVtOceC2S\nn8KbSty/vRM5uRpKCL8hY/BM+wM5DligVQJ7CnX/Saong88VHsMPSjEh2BHhuDHf\nbX0Lo9toNwlCgmkXaw9+/+gJh8xB+d24GQ9CvFLFnDR6d3jqEtvumqv2\n-----END CERTIFICATE-----\",
\"client_public_key_signature\": \"hmghKNw5I8f5MM8/ZUn0HHwZmUj+hyEldYtn511RWevXBLR4N0taRHhS5XIzG0pEG9GkHHF4KKEwca8VUgiRDu+Zv0zjAAzCb11O2mHf4UojKrldaEtz9nHIYLb+ANSR2dXGPLeXo6/zjBEaun2BxVnydFu+wArqPx2WEw9SNZqpD1zGJcXZsfZa/F720vQ1se3R92UTVMieNeJR5bzFS4C7NN7RPO/yZqtOmbyaO58TqOOQx4YZ6tA/us47e98Nehd8tDkIzsoWDo5eyNUkONu01OezjAl00dnhExg+/yonsZR2LAVRc35KKf8pWeKyaaN+OIyEueF1M6BN5rhvLg==\"
}"

curl -v -X POST "https://public-api.sandbox.bunq.com/v1/payment-service-provider-credential" \
-H "User-Agent: curl" \
-H "Content-Type: application/json" \
-H "X-Bunq-Client-Authentication: $installationToken" \
-d "$request"
But was an unexpected for me exception:{"Error":[{"error_description":"You can have at most 5 active server credentials.","error_description_translated":"You can have at most 5 active server credentials."}]}`

What is server credentials and how it possible that I have 5 because I tried only 2 times?

Bastiaan

Deviprasad Hi!

Maybe you get this error about 5 active server credentials because you use a certificate with a "Common Name" (CN) that is already used in another test certificate.

Check my repository on GitHub, maybe this info can help you: https://github.com/basst85/bunq_psd2_example

New-Pink-Lion-2906228819

Bastiaan Thanks a lot!
It has sense, I've tried with the template from the portal "CN=My App PISP AISP/C=NL"

New-Pink-Lion-2906228819

Bastiaan Hi,
found a mistake in your repo.
For the payment-service-provider-credential call for the signing uses the wrong private key:
For the installation call uses public key that was generated from the client private key but signing performed with the psd2_key.pem.
And in this case we always receive {"Error":[{"error_description":"Invalid signature for public key.","error_description_translated":"Invalid signature for public key."}]}