analyze /device/<GUID>/certificate

README.md

@@ -106,6 +106,7 @@ The first request was only send once - all other setup tries skipped the first r
     ```http
     POST https://common.lgthinq.com/device/<GUID>/certificate
     User-Agent:      IOE Client
+    Content-Type:    application/json
     {
         "ciphertext": "<base64>",
         "csr": "-----BEGIN CERTIFICATE REQUEST-----
@@ -118,4 +119,14 @@ The first request was only send once - all other setup tries skipped the first r
     }
 
     <unknown>
-    ```
+    ```
+
+## Findings
+
+### clip.com
+
+the subject fo the csr is [CN=*.clip.com, O=LGE, C=KR](https://clip.com/)
+
+### the server seems to use python 
+
+the `/device/<GUID>/certificate` endpoint returns the error [Invalid ciphertext: Ciphertext length must be equal to key size.](https://github.com/pyca/cryptography/blob/e343723356e29f22d74516e251c87ed829c59667/src/rust/src/backend/rsa.rs#L322) if the ciphertext parameter does not match the csr or publickey.

src/lgthinqapi/lgthinqapi.http

@@ -1,5 +1,6 @@
 @host_common = common.lgthinq.com
 @host_region = eic-common.lgthinq.com
+@device_guid = 6F24DBBA-B91C-4105-99EA-F47E66AC9D7E
 
 GET https://{{host_common}}/route
 User-Agent:       IOE Client
@@ -13,4 +14,16 @@ GET https://{{host_region}}/route/certificate
 
 ###
 
-GET https://{{host_region}}/route/certificate?name=common-server
+GET https://{{host_region}}/route/certificate?name=common-server
+
+###
+
+POST https://{{host_region}}/device/{{device_guid}}/certificate
+Content-Type:    application/json
+
+{
+  "ciphertext":"qqqq",
+  "csr":"q",
+  "otp":"q",
+  "publickey":"-----BEGIN PUBLIC KEY-----\nqqqq\n-----END PUBLIC KEY-----"
+}