Acmev2, where to get intermediate cert?

Wulf4096 · January 5, 2018, 2:55am

https://acme-staging-v02.api.letsencrypt.org/acme/order/5337306/23
https://acme-staging-v02.api.letsencrypt.org/acme/cert/fa3f614c7c0ca83b39ae7fcaa01f2e694004 returns only the server certificate, not the intermediate.
Is that to be expected?

ahaw021 · January 5, 2018, 3:10am

I opened the cert in windows MMC and was able to get the other two

below are the PEM versions

feel free to test them with an online tool first

LE FAKE ROOT

LE Fake Intermediate:

Wulf4096 · January 5, 2018, 3:12am

Okay, but where do I download the intermediate cert by using the acme protocol?

ahaw021 · January 5, 2018, 3:27am

according to the spec it should be a chain (however as this is a testing service it may not have been implmented)

7.4.2. Downloading the Certificate

To download the issued certificate, the client simply sends a GET
request to the certificate URL.

The default format of the certificate is application/pem-certificate-
chain (see IANA Considerations).

The server MAY provide one or more link relation header fields
[RFC5988] with relation “alternate”. Each such field SHOULD express
an alternative certificate chain starting with the same end-entity
certificate. This can be used to express paths to various trust
anchors. Clients can fetch these alternates and use their own
heuristics to decide which is optimal.

GET /acme/cert/asdf HTTP/1.1
Host: example.com
Accept: application/pkix-cert

HTTP/1.1 200 OK
Content-Type: application/pem-certificate-chain
Link: https://example.com/acme/some-directory;rel=“index”

A certificate resource represents a single, immutable certificate.
If the client wishes to obtain a renewed certificate, the client
initiates a new order process to request one.

Because certificate resources are immutable once issuance is
complete, the server MAY enable the caching of the resource by adding

Barnes, et al. Expires June 17, 2018 [Page 42]

Internet-Draft ACME December 2017

Expires and Cache-Control headers specifying a point in time in the
distant future. These headers have no relation to the certificate’s
period of validity.

The ACME client MAY request other formats by including an Accept
header in its request. For example, the client could use the media
type “application/pkix-cert” [RFC2585] to request the end-entity
certificate in DER format. Server support for alternate formats is
OPTIONAL. For formats that can only express a single certificate,
the server SHOULD provide one or more “Link: rel=“up”” headers
pointing to an issuer or issuers so that ACME clients can build a
certificate chain as defined in TLS.

ahaw021 · January 5, 2018, 3:28am

i had a look at what the testing server returns and the content-type is right however i would expect to see 3x certificates - hopefully one of the other guys can chip in

mnordhoff · January 5, 2018, 4:18am

Well for now you ought to be able to download it via the AIA extension in the certificate… But from what ahaw021 says this sounds like a Boulder bug/limitation.

fengjiajie · January 5, 2018, 6:50am

You can download staging(ACME v2 same) intermediate cert from:

https://letsencrypt.org/docs/staging-environment/#root-certificate

https://letsencrypt.org/certs/fakeleintermediatex1.pem

jsha · January 5, 2018, 6:55am

Yep, @ahaw021’s got it right. It’s supposed to be a PEM certificate chain, and in Pebble it is. However, we have not yet implemented the chain part in Boulder’s wfe2: https://github.com/letsencrypt/boulder/issues/3291.

system · February 4, 2018, 6:55am

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
How to get certificate-only without root chain? Help	4	1400	July 11, 2019
Let's Encrypt Staging Root	10	7700	June 29, 2018
Staging endpoint for ACME v2 API Announcements	1	160054	March 13, 2018
Getting Certificates issuers Help	5	556	June 15, 2024
Receiving two certificates? Issuance Tech	5	866	December 14, 2019

Acmev2, where to get intermediate cert?

Related topics