MDM CSR with out vendor signing – Unable to generate APNs certificates (“Invalid CSR” error)

Query:

I’m at the moment engaged on a prototype MDM (Cellular Gadget Administration) resolution, just like JMAF, for inside use inside my firm.

I’ve:

• An Apple Developer account (firm)

• An Apple Enterprise Supervisor account

Nevertheless, my Apple Developer account does not have permission to generate the MDM Vendor Certificates.

What I’ve tried

• I used to be capable of generate an APNs certificates utilizing a third-party service (e.g., https://mdmcert.obtain), and I can efficiently:

  • Receive an APNs certificates

  • Push configuration profiles to gadgets

• Nevertheless, when I attempt to generate my very own CSR and add it on to the Apple Push Certificates Portal:
  https://identification.apple.com/pushcert/

I get the next error:

"Invalid Certificates Signing Request"

My understanding / confusion

From some articles and discussions, I perceive that:

• If the MDM resolution is for inside use solely, it might not require a vendor-signed CSR

• In that case, it needs to be doable to add a self-generated CSR

Nevertheless, in follow, Apple retains rejecting my CSR.

Questions

1. Is it really doable to generate an APNs certificates for MDM with out a vendor-signed CSR?

2. If sure, what are the precise necessities/format for the CSR that Apple accepts?

3. If not, does this imply that getting a Vendor Certificates is obligatory even for inside MDM options?