# Acme.sh supports Google CA, try it!

**URL:** <https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804>\
**Category:** Client dev\
**Created:** [March 30, 2022, 3:13pm UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804 "2022-03-30T15:13:11Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Neilpang](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/neilpang/32/20232_2.png) [@Neilpang](https://community.letsencrypt.org/u/Neilpang)\
**Post date:** [March 30, 2022, 3:13pm UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/1 "2022-03-30T15:13:11Z")

</div>

Google just announced its free public ACME CA.

It supports multiple domains and wildcard domains.

Here is the step by step usage:

> **[Google public CA · acmesh-official/acme.sh Wiki](https://github.com/acmesh-official/acme.sh/wiki/Google-public-CA)**
>
> A pure Unix shell script implementing ACME client protocol - Google public CA · acmesh-official/acme.sh Wiki

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [March 30, 2022, 3:16pm UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/2 "2022-03-30T15:16:08Z")

</div>

I kinda was too early and I had an issue, I had to edit the account.conf file because for some reason the EAB command line options didn't work.

---

<div class="post-metadata">

**Author:** ![Neilpang](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/neilpang/32/20232_2.png) [@Neilpang](https://community.letsencrypt.org/u/Neilpang)\
**Post date:** [March 30, 2022, 3:40pm UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/3 "2022-03-30T15:40:24Z")

</div>

emmm, can you please show me the log with `--debug 2` ?

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [March 30, 2022, 3:49pm UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/4 "2022-03-30T15:49:59Z")

</div>

I upgraded. The log (level 1?) shows

```nohighlight
[Wed 30 Mar 2022 02:25:18 PM UTC] ACME_DIRECTORY='https://dv.acme-v02.api.pki.goog/directory'
[Wed 30 Mar 2022 02:25:18 PM UTC] _init api for server: https://dv.acme-v02.api.pki.goog/directory [Wed 30 Mar 2022 02:25:18 PM UTC] Use default length 2048
[Wed 30 Mar 2022 02:25:18 PM UTC] length='2048'
[Wed 30 Mar 2022 02:25:18 PM UTC] Using config home:/root/.acme.sh
[Wed 30 Mar 2022 02:25:18 PM UTC] ACME_DIRECTORY='https://dv.acme-v02.api.pki.goog/directory'
[Wed 30 Mar 2022 02:25:18 PM UTC] Use length 2048
[Wed 30 Mar 2022 02:25:18 PM UTC] Using RSA: 2048
[Wed 30 Mar 2022 02:25:18 PM UTC] Create account key ok.
[Wed 30 Mar 2022 02:25:18 PM UTC] RSA key
[Wed 30 Mar 2022 02:25:18 PM UTC] config file is empty, can not read CA_EAB_KEY_ID
[Wed 30 Mar 2022 02:25:18 PM UTC] config file is empty, can not read CA_EAB_HMAC_KEY
[Wed 30 Mar 2022 02:25:18 PM UTC] Registering account: https://dv.acme-v02.api.pki.goog/directory
[Wed 30 Mar 2022 02:25:18 PM UTC] url='https://dv.acme-v02.api.pki.goog/new-account'
[Wed 30 Mar 2022 02:25:18 PM UTC] payload='{"contact": ["mailto:me@example.com"], "termsOfServiceAgreed": true}' [Wed 30 Mar 2022 02:25:18 PM UTC] HEAD
[Wed 30 Mar 2022 02:25:18 PM UTC] _post_url='https://dv.acme-v02.api.pki.goog/new-nonce'
[Wed 30 Mar 2022 02:25:18 PM UTC] _CURL='curl --silent --dump-header /root/.acme.sh/http.header -L -g -I ' [Wed 30 Mar 2022 02:25:19 PM UTC] _ret='0'
[Wed 30 Mar 2022 02:25:20 PM UTC] POST
[Wed 30 Mar 2022 02:25:20 PM UTC] _post_url='https://dv.acme-v02.api.pki.goog/new-account'
[Wed 30 Mar 2022 02:25:20 PM UTC] _CURL='curl --silent --dump-header /root/.acme.sh/http.header -L -g ' [Wed 30 Mar 2022 02:25:20 PM UTC] _ret='0'
[Wed 30 Mar 2022 02:25:20 PM UTC] code='400'
[Wed 30 Mar 2022 02:25:20 PM UTC] Register account Error: {"type":"urn:ietf:params:acme:error:externalAccountRequired","detail":"External Account Binding is required for new accounts. See https://tools.ietf.org/html/rfc8555#section-7.3.4 for more information."}
[Wed 30 Mar 2022 02:25:20 PM UTC] _on_issue_err
[Wed 30 Mar 2022 02:25:20 PM UTC] Please check log file for more details: /root/.acme.sh/acme.sh.log       

```

I did add the two appropriate options (together with `--issue`, though, and replacing an existing certificate) but it only started working when I added the `CA_EAB_KEY_ID` and `CA_EAB_HMAC_KEY` variables in `/root/.acme.sh/ca/dv.acme-v02.api.pki.goog/directory/ca.conf`

---

<div class="post-metadata">

**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\
**Post date:** [March 30, 2022, 11:37pm UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/5 "2022-03-30T23:37:55Z")

</div>

Sweet @Neilpang saw you're tweet and requested access. Just waiting on Google's approval/email 🙂

---

<div class="post-metadata">

**Author:** ![Neilpang](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/neilpang/32/20232_2.png) [@Neilpang](https://community.letsencrypt.org/u/Neilpang)\
**Post date:** [March 30, 2022, 11:45pm UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/6 "2022-03-30T23:45:03Z")

</div>

Sorry, there was a missing in the wiki, please register the account with eab kid/hmakey first:

```nohighlight
acme.sh --register-account -m myemail@example.com --server google \
    --eab-kid xxxxxxx \
    --eab-hmac-key xxxxxxx

```

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [March 30, 2022, 11:57pm UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/7 "2022-03-30T23:57:52Z")

</div>

Wow, thanks for the news (and acme.sh compatibility), @Neilpang!

This goes to show just how huge a success the ACME protocol has been. 😀

I'm kind of curious about the close timing match between Google's creation of this service and their discontinuation of their CT query tool. Is there some reason that they would specifically not want to run both of those things simultaneously?

---

<div class="post-metadata">

**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\
**Post date:** [March 31, 2022, 12:03am UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/8 "2022-03-31T00:03:15Z")

</div>

> [@schoen](#):
>
> I'm kind of curious about the close timing match between Google's creation of this service and their discontinuation of their CT query tool. Is there some reason that they would specifically not want to run both of those things simultaneously?

Haven't read but is the Google CA issued certs going to have rate limits, if not, maybe CT wouldn't have been able to handle the load?

> [@Neilpang](#):
>
> Sorry, there was a missing in the wiki, please register the account with eab kid/hmakey first:

Noted 😃

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [March 31, 2022, 6:56am UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/9 "2022-03-31T06:56:41Z")

</div>

> [@eva2000](#):
>
> Haven't read but is the Google CA issued certs going to have rate limits,

Yes. There's a page detailing them in the support section, but it's not easy to find and only available once you get approved for the beta.

---

<div class="post-metadata">

**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\
**Post date:** [March 31, 2022, 8:28am UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/10 "2022-03-31T08:28:43Z")

</div>

Cheers just got approved and using gcloud generated my credentials. Though the doc and quick start pages are still 404 not found fo rme.

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [March 31, 2022, 8:33am UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/11 "2022-03-31T08:33:58Z")

</div>

You have to create a project and enable the publicca API before they're visible, I think.

---

<div class="post-metadata">

**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\
**Post date:** [March 31, 2022, 8:41am UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/12 "2022-03-31T08:41:12Z")

</div>

Yeah I created the project and enabled the publicca API but still 404 on documents.

@Neilpang using acme.sh v3.03 or dev branch, on 1st server registering an account worked

```nohighlight
acme.sh --register-account -m myemail@example.com --server google \
    --eab-kid xxxxxxx \
    --eab-hmac-key xxxxxxx

```

but doing same on 2nd server gives me?

`Register account Error: {"type":"urn:ietf:params:acme:error:unauthorized","detail":"Unknown external account binding key."}`

---

<div class="post-metadata">

**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\
**Post date:** [March 31, 2022, 8:47am UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/13 "2022-03-31T08:47:55Z")

</div>

If you have multiple google accounts and one is your google cloud admin account you will see working URLs have something like `?authuser=2` at the end. Append that (the number will vary depending on your accounts) to the link, that's what worked for me.

---

<div class="post-metadata">

**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\
**Post date:** [March 31, 2022, 8:49am UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/14 "2022-03-31T08:49:09Z")

</div>

append to which part ?

edit: oh you mean to 404 URLs. Thank worked I can see them now!

---

<div class="post-metadata">

**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\
**Post date:** [March 31, 2022, 8:56am UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/15 "2022-03-31T08:56:51Z")

</div>

Ah I need a unique key/credentials for each registration!

> You can only register one ACME account with an EAB secret. After you have registered an ACME account using an EAB secret, the EAB secret becomes invalid and you can't reuse it. If you want to register multiple ACME accounts, you must request a unique EAB secret for each of the accounts.

---

<div class="post-metadata">

**Author:** ![Neilpang](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/neilpang/32/20232_2.png) [@Neilpang](https://community.letsencrypt.org/u/Neilpang)\
**Post date:** [March 31, 2022, 8:57am UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/16 "2022-03-31T08:57:03Z")

</div>

seem to me too.

It seems the eab secrets is one-time use.

---

<div class="post-metadata">

**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\
**Post date:** [March 31, 2022, 9:12am UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/17 "2022-03-31T09:12:11Z")

</div>

> [@Neilpang](#):
>
> It seems the eab secrets is one-time use.

Which is the same for ZeroSSL, so it's _fairly_ standard. I think maybe `ssl.com` allows re-use of the credentials.

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [March 31, 2022, 9:27am UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/18 "2022-03-31T09:27:50Z")

</div>

It also expires in 7 days if you do not use it.

---

<div class="post-metadata">

**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\
**Post date:** [April 1, 2022, 3:50am UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/19 "2022-04-01T03:50:35Z")

</div>

Cheers guys!

@Neilpang does using Google CA require acme.sh dev branch or the current v3.0.3 version can work?

---

<div class="post-metadata">

**Author:** ![Neilpang](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/neilpang/32/20232_2.png) [@Neilpang](https://community.letsencrypt.org/u/Neilpang)\
**Post date:** [April 1, 2022, 4:07am UTC](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804/20 "2022-04-01T04:07:13Z")

</div>

No, you can use the current master branch.

[Next page](https://community.letsencrypt.org/t/acme-sh-supports-google-ca-try-it/174804.md?page=2)