# Debugging Pebble EC Account Keys? **URL:** \ **Category:** Client dev\ **Created:** [December 31, 2024, 2:07am UTC](https://community.letsencrypt.org/t/debugging-pebble-ec-account-keys/231109 "2024-12-31T02:07:32Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![jvanasco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jvanasco/32/55900_2.png) [@jvanasco](https://community.letsencrypt.org/u/jvanasco)\ **Post date:** [December 31, 2024, 2:07am UTC](https://community.letsencrypt.org/t/debugging-pebble-ec-account-keys/231109/1 "2024-12-31T02:07:32Z")
I am trying to upgrade our internal client to support EC account keys, and Pebble does not like my payloads or signatures. I keep getting the following error: > {'type': 'urn:ietf:params:acme:error:malformed', 'detail': 'JWS verification error: go-jose/go-jose: error in cryptographic primitive', 'status': 400} My signatures verify. The post data is in-line with what other clients push out successfully. I can build a valid JWK object from the dict I post. This only happens with EC keys, the RSA work fine. Does anything have an idea on what/where to troubleshoot in Pebble or potential causes for this on my end? I've seen a handful of similar issues in the archive and online; most people give up and still with RSA. ---
**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\ **Post date:** [December 31, 2024, 2:17am UTC](https://community.letsencrypt.org/t/debugging-pebble-ec-account-keys/231109/2 "2024-12-31T02:17:22Z")
Check your field order in the json version of the key, it's has to be the specific order and without padding etc so that the signature is valid. ---
**Author:** ![Nummer378](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/nummer378/32/49862_2.png) [@Nummer378](https://community.letsencrypt.org/u/Nummer378)\ **Post date:** [December 31, 2024, 3:13am UTC](https://community.letsencrypt.org/t/debugging-pebble-ec-account-keys/231109/3 "2024-12-31T03:13:27Z")
A very common issue with the JWS EC signatures is the signature format. If you're using a ready-made JWS library it will hopefully already do this correctly, but if you're doing the signing by yourself check that you're using PKCS#11 signatures (raw r+s values concatenated, no encoding) and not the also very common DSS signatures (DER encoded version of r+s). For instance, in certbot/josepy (which uses Python's cryotography package), you have to call [decode\_dss\_signature](https://github.com/certbot/josepy/blob/2731969a8460a3ae0dcbcdc65be772385eb4a89e/src/josepy/jwa.py#L152) on the signature generated by cryptography to get the raw values from the DSS DER (and then properly concatenate them). Other libraries might give you PKCS#11 ECDSA signatures directly - this varies from implementation to implementation. ---
**Author:** ![jvanasco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jvanasco/32/55900_2.png) [@jvanasco](https://community.letsencrypt.org/u/jvanasco)\ **Post date:** [December 31, 2024, 3:32am UTC](https://community.letsencrypt.org/t/debugging-pebble-ec-account-keys/231109/4 "2024-12-31T03:32:08Z")
> [@Nummer378](#): > > For instance, in certbot/josepy (which uses Python's cryotography package), I was using josepy to sign, so you pointed me to the **exact** code to adapt. Everything is working well now. Ironically, I was going to drop josepy a few weeks ago but decided to still use it, and before the holidays I generated some PRs for potential ways to drop the last bits of pyOpenSSL. I was just waist deep in that code, and did not connect the dots to my issue today! Thanks so much! It would have taken me way too long to figure that out myself. > [@webprofusion](#): > > Check your field order in the json version of the key, it's has to be the specific order and without padding etc so that the signature is valid. That was not causing an issue, but only by virtue of using some libraries that unknowingly took care of that. I added some code to ensure keys are sorted appropriately - thanks so much! ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [January 30, 2025, 3:32am UTC](https://community.letsencrypt.org/t/debugging-pebble-ec-account-keys/231109/5 "2025-01-30T03:32:29Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.