# Cerbot client authentication with EJBCA ACME server **URL:** \ **Category:** Help\ **Created:** [March 2, 2023, 1:15am UTC](https://community.letsencrypt.org/t/cerbot-client-authentication-with-ejbca-acme-server/193713 "2023-03-02T01:15:07Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![myatsko-1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/myatsko-1/32/68210_2.png) [@myatsko-1](https://community.letsencrypt.org/u/myatsko-1)\ **Post date:** [March 2, 2023, 1:15am UTC](https://community.letsencrypt.org/t/cerbot-client-authentication-with-ejbca-acme-server/193713/1 "2023-03-02T01:15:07Z")
My client wants to use Certbot with an EJBCA ACME server to automatically enroll and renew TLS certificates. I've followed the EJBCA guide ([https://doc.primekey.com/ejbca/ejbca-operations/ejbca-ca-concept-guide/protocols/acme](https://doc.primekey.com/ejbca/ejbca-operations/ejbca-ca-concept-guide/protocols/acme)) and successfully enrolled, renewed, and revoked the TLS certificates using standard Certbot 2.3.0 commands. But, my client has a hard requirement to enable client authentication for run these commands. While client authentication is supported by the EJBCA ACME server (see EJBCA guide above), I haven't been able to find any client authentication flags. Are there any Certbot flags for client authentication? I couldn't find anything in this forum or Cerbot documenation ([Welcome to the Certbot documentation! — Certbot 2.3.0 documentation](https://eff-certbot.readthedocs.io/en/stable/)). Chat GPT suggested this command and flags: sudo certbot certonly --webroot -w /var/www/html -d [example.com](http://example.com) --client-cert /path/to/client/certificate.pem --client-key /path/to/client/private/key.pem But, the --client-cert and -client-key flags didn't work in my tests. Chat GPT further said the flags were added in V.1.15.0. If anyone knows whether Certbot supports client authentication, I would appreciate it. Thanks. ---
**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\ **Post date:** [March 2, 2023, 1:18am UTC](https://community.letsencrypt.org/t/cerbot-client-authentication-with-ejbca-acme-server/193713/2 "2023-03-02T01:18:08Z")
--eab-kid EAB\_KID Key Identifier for External Account Binding (default: None) --eab-hmac-key EAB\_HMAC\_KEY [https://eff-certbot.readthedocs.io/en/stable/using.html](https://eff-certbot.readthedocs.io/en/stable/using.html) ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [March 2, 2023, 1:22am UTC](https://community.letsencrypt.org/t/cerbot-client-authentication-with-ejbca-acme-server/193713/3 "2023-03-02T01:22:49Z")
All the [DV] certs LE provides are for client and server authentication. But "client authentication" may mean different things to different people. What exactly does your "client authentication" use mean to you? [feel free to use third grade English (or lower - using _simplified wording_ can sometimes do better)] For instance, in your post you use the word "client" to means different things [in different context of course] - but this can be confusing to anyone not well versed in English OR when (lost in) translation. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [March 2, 2023, 1:24am UTC](https://community.letsencrypt.org/t/cerbot-client-authentication-with-ejbca-acme-server/193713/4 "2023-03-02T01:24:05Z")
If you mean to say that you need Certbot to authenticate to the ACME server via a TLS Client Certificate (a.k.a mutual TLS/mTLS), it is not possible. This would need to be a new feature in Certbot and we currently have no plans to implement it. ---
**Author:** ![myatsko-1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/myatsko-1/32/68210_2.png) [@myatsko-1](https://community.letsencrypt.org/u/myatsko-1)\ **Post date:** [March 2, 2023, 2:03am UTC](https://community.letsencrypt.org/t/cerbot-client-authentication-with-ejbca-acme-server/193713/5 "2023-03-02T02:03:56Z")
Thank you for the responses. My client wants web servers to present a certificate (with a Client Auth EKU) to the EJBCA ACME server for mutual authentication for the TLS connections. I'll talk with my client about submitting a feature request for it. If so, I'll submit a new post. While EJBCA ACME server does support EAB\_KID and EAB\_HMAC\_KEY, it only works for account registration. The EJBCA ACME server ignores these flags for certificate operations. I can see your point about the many Client Auth meanings and will be more specific in the future. Once again, thank you everyone for your help. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 2, 2023, 7:17am UTC](https://community.letsencrypt.org/t/cerbot-client-authentication-with-ejbca-acme-server/193713/6 "2023-03-02T07:17:00Z")
> [@myatsko-1](#): > > Chat GPT further said the flags were added in V.1.15.0. ROFL 🤣 Are we asking a novice AI now for help regarding software applications? Why not just check out the Certbot documentation at [User Guide — Certbot 2.6.0 documentation](https://eff-certbot.readthedocs.io/en/stable/using.html) where you can see no such options exist? ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [March 2, 2023, 3:52pm UTC](https://community.letsencrypt.org/t/cerbot-client-authentication-with-ejbca-acme-server/193713/7 "2023-03-02T15:52:57Z")
> [@myatsko-1](#): > > My client wants web servers to present a certificate (with a Client Auth EKU) to the EJBCA ACME server for mutual authentication for the TLS connections. I'll talk with my client about submitting a feature request for it. If so, I'll submit a new post. Hmm. That's interesting, I haven't heard of anyone using ACME in that way. I'm kind of surprised if they implemented it without having a client in mind that could use it; maybe even if certbot doesn't support it they know of other clients that make using it simple-ish? ---
**Author:** ![myatsko-1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/myatsko-1/32/68210_2.png) [@myatsko-1](https://community.letsencrypt.org/u/myatsko-1)\ **Post date:** [March 2, 2023, 4:07pm UTC](https://community.letsencrypt.org/t/cerbot-client-authentication-with-ejbca-acme-server/193713/8 "2023-03-02T16:07:56Z")
Since I didn't find anything in the Certbot documentation, I tried Chat GPT as a last resort. Suprisingly, Chat GPT is fairly good at writing code and trouble shooting issues if you can structure the queries in a way it understands. I was surprised that it identified the --client-cert and --client-key flags to the Certbot 1.15.0 version so I thought that I would ask. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 2, 2023, 5:02pm UTC](https://community.letsencrypt.org/t/cerbot-client-authentication-with-ejbca-acme-server/193713/9 "2023-03-02T17:02:17Z")
> [@myatsko-1](#): > > Suprisingly, Chat GPT is fairly good at writing code and trouble shooting issues if you can structure the queries in a way it understands. I was surprised that it identified the --client-cert and --client-key flags to the Certbot 1.15.0 version so I thought that I would ask. Unfortunately, ChatGPT was incorrect, as ChatGPT itself confirms: > Does Certbot have the options "--client-cert" and "--client-key"? > No, Certbot does not have the options "--client-cert" and "--client-key". > Certbot is a command-line tool for managing SSL/TLS certificates, and it provides a range of options and flags for different operations. However, "--client-cert" and "--client-key" are not valid options in Certbot. 😃 I would not trust ChatGPT above common sense like just looking in the documentation 😉 ---
**Author:** ![jvanasco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jvanasco/32/55900_2.png) [@jvanasco](https://community.letsencrypt.org/u/jvanasco)\ **Post date:** [March 2, 2023, 5:03pm UTC](https://community.letsencrypt.org/t/cerbot-client-authentication-with-ejbca-acme-server/193713/10 "2023-03-02T17:03:25Z")
> [@myatsko-1](#): > > Chat GPT is fairly good at writing code and trouble shooting issues if you can structure the queries in a way it understands Yet, experienced programmers consistently say the exact opposite. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [April 1, 2023, 5:04pm UTC](https://community.letsencrypt.org/t/cerbot-client-authentication-with-ejbca-acme-server/193713/11 "2023-04-01T17:04:09Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.