I'm trying to automate the creation of Wireguard profiles to connect to various Proton VPN servers. As far as I can tell, when you generate one online through account.proton.me:

• The client generates a private key in-browser.
• Client POSTs the corresponding public key, along with the chosen server and some other parameters, to /api/vpn/v1/certificate.
• Server registers the given public key and returns the parameters that should be used to construct the config file.
• Client combines returned parameters with the private key to create the final config file.

I am attempting to replicate this process with a key generated using wg:

wg genkey | tee privkey.key | wg pubkey > pubkey.key

However when sending this pubkey to the server (leaving everything else exactly as captured from a working in-browser request), it responds with:

{
  "Code": 2001,
  "Error": "Unable to read the key, please provide a valid EC key",
  "Details": {}
}

Replacing my custom pubkey with a pre-existing pubkey from a config generated through the Web UI instead returns ClientPublicKey fingerprint conflict, please regenerate a new key, so I don't think I'm messing up the request format.

My questions are:

• Is there a better/more official way to do this? I couldn't find anything searching.
• Why does this not work? Surely wg creates valid EC keys? Does Proton have some additional constraints on valid keys for some reason?

I don't have much (or really any) experience with WireGuard, so perhaps I'm missing something obvious? Any help would be appreciated.

All our servers and company laptops went down at pretty much the same time. Laptops have been bootlooping to blue screen of death. It's all very exciting, personally, as someone not responsible for fixing it.

Apparently caused by a bad CrowdStrike update.

Edit: now being told we (who almost all generally work from home) need to come into the office Monday as they can only apply the fix in-person. We'll see if that changes over the weekend...