ACME Email S/MIME - All authorizations were not finalized by the CA

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: jfiger.com

I ran this command:
python3 cli.py cert --config-dir . --work-dir . --logs-dir . -e jfiger@figer.com --contact jfiger@gmail.co

It produced this output:
All authorizations were not finalized by the CA.
My web server is (include version):

The operating system my web server runs on is (include version):
Linux or Windows 11 produce the same output
My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):yes

2

That is not a public domain name. Let's Encrypt only issues certificates for public names.

What Certificate Authority are you using?

And, what ACME Client does cli.py run? If it is one where did you get it?

2 Likes
3

Sorry, my domain is figer.com
Iuse the acme_email client for the https://acme.castle.cloud/
I downloaded here GitHub - polhenarejos/acme_email: ACME Email Client for EmailReply-00 Challenge
and run in python either on Windows 11 or Ubuntu 24.04 LTS with the root certificate of https://acme.castle.cloud/

4

It's a bug in the client, it will be trying to finalize the order before all the identifiers have been validated, however this seems to involve a custom S/MIME centric ACME server as well, so it doesn't seem like it's anything to do with Let's Encrypt? Or maybe it is, I can't tell.

2 Likes
5

Digging into this out of interest, this is a special ACME server that does email validation, so presumably RFC 8823 - Extensions to Automatic Certificate Management Environment for End-User S/MIME Certificates

You should raise the issue with the Castle ACME server people as it's their client as well.

3 Likes
6

Not related to Let's Encrypt that I can tell either :slight_smile:

But, their ACME Client uses Certbot. And, as we know well, for any error Certbot suggests people come to this forum even for problems using other Certificate Authorities (CA).

@jfiger Certbot is a popular ACME Client to get Let's Encrypt certificates (an ACME Server). But, Certbot is maintained by the EFF. We do not focus on helping people when using it with other CA. Sometimes a volunteer will offer a suggestion anyway but problems are better directed to Certbot's github or the Certificate Authority. Just adding this added background for clarity.

From the ACME Email S/MIME github:

Certbot is a powerful software for managing the ACME procedure, but it only supports "dns" Identifier Types in the CSR, which is incompatible with S/MIME certificates requiring "email" Identifier Types. To address this, the client provides a workaround using the --csr parameter to accept external CSRs. The client comprises ...

4 Likes
7

when I touched that that server did something weird (iirc using dns identifier but filled with email address) so I don't think id support anything other then their own client

1 Like
8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.