search

dehydrated-io / dehydrated

letsencrypt/acme client implemented as a shell-script – just add water
https://dehydrated.io
MIT License
5.97k stars 716 forks source link

External Account Binding support. #742

Closed tzim-fr closed 3 years ago

tzim-fr commented 4 years ago

Certigo service support ACME, but it requires support for "external account binding" (see section 7.3.4 in acme specs) at registration.

If I understand the specs correctly, only the newAccount request needs to be modified. Is there plans to implement this feature ?

lukas2511 commented 4 years ago

Looks easy to implement, but I have nowhere to actually test this...

Note to self: https://tools.ietf.org/html/rfc8555#section-7.3.4

cpu commented 4 years ago

I have nowhere to actually test this...

Pebble supports external account binding.

lukas2511 commented 4 years ago

I have nowhere to actually test this...

Pebble supports external account binding.

Ah, @cpu to the rescue ;)

Was going to set up Pebble anyway for automatic testing, will work on this feature when my test environment is back up! :+1:

sigio commented 3 years ago

Zerossl is now live, which is sectigo's ssl service CA ACME endpoint is at https://acme.zerossl.com/v2/DV90

Trying to use it returns:

{"type":"urn:ietf:params:acme:error:externalAccountRequired","status":400,"detail":"The request must include a value for the \"externalAccountBinding\" field"}

saz commented 3 years ago

You should set EAB_KID/EAB_HMAC_KEY in your config

sigio commented 3 years ago

Thanks... that worked (as soon as I upgraded to latest version :P )

lukas2511 commented 3 years ago

This is now implemented.