Hello, I need help to understand what form should this certbot parameter take. The online documentation does not answer this question except that in the sample config file, it says
"eab-hmac-key = yaddayaddahexhexnotquoted"
I tried hex form of binary 64-byte key generated by "openssl rand -hex 64" but it doesn't seem to work. I get "externalAccountBinding signature verification failure".
RFC says that it should be in base64url form. Is it hex of this form? I've also tried it too with the same result.
What I have tried is this:
I extracted the payload from the certbot log file:
"ewogICJjb250YWN0IjogWwogICAgIm1haWx0bzphcG9saWFrZXZpdGNoQHRpbWJyZWRpZ2l0YWwuY28ubnoiCiAgXSwKICAidGVybXNPZlNlcnZpY2VBZ3JlZWQiOiB0cnVlLAogICJleHRlcm5hbEFjY291bnRCaW5kaW5nIjogewogICAgInByb3RlY3RlZCI6ICJleUpoYkdjaU9pQWlTRk15TlRZaUxDQWlhMmxrSWpvZ0ltRndiMnhwWVd0bGRtbDBZMmdpTENBaWRYSnNJam9nSW1oMGRIQnpPaTh2Y0d0cExuUmxZMmhqYjNKd1lYQndjeTVqYjIwdllXTnRaUzl1WlhjdFlXTmpiM1Z1ZENKOSIsCiAgICAic2lnbmF0dXJlIjogIlpVYzIxaVFfcUZQZXBwVV9CME0tMXNQaEN3MUZnNWZmd0tMbkNYbjVzY00iLAogICAgInBheWxvYWQiOiAiZXlKdUlqb2dJbkZLWWpsUk5IRjZNVUZ5T1ZWVWJFazBSVGxLTTFVd1gxcE5aVzlOTFZKYVVUWXRkRUV5WlhWVlJsY3hWRlZKV0d4Mk1GUnlWVlZ3U0hwcmFXaGlWRlJ5UjBGalVYcFFhVTVpWmsxTVExRmlZMVF5TVV0dGRYWTVUMnhWVlV4dmNsUkxUWFE1Ylhoc05FRm5jVXh0Y1d4alpFVllhREJLYlRkU2FrWlhiMHAyWTFOR1NtOVpXbmRuTUVocFUxWTVWREJCUkY4MVltaDBSRmxOZUdadGJrVnFXRjlEVVc1VFlsUjJOV3RsWDBORVEzRkpRekZoZW1zeVJuazFVSFZsYW01Vk16TklZM1JuUm1kUFRsZ3hhblp0VnpoR01EQkJlbHB3VG05eFJHNTVaM0pZTjFaRE1uUk1XRVZUTm5JeUxWSkNialprYkdoMlVuTnpUR3A0VTBOeVprOVNPR1EyTnpVeWRUUTRMVlJMWlhrMWNTMHpRbGM1Tm05TlYyZzRiVFo0TTJSZk1IZDBUbTV3ZG13d04wcFRVVlUzWVZnNFJVeEViekZaU1V0cFJ6RTNPV05TWTJsNVRXVlJOV2RrVnpRNVZrWnRVU0lzSUNKbElqb2dJa0ZSUVVJaUxDQWlhM1I1SWpvZ0lsSlRRU0o5IgogIH0KfQ"
I base64url decoded it to get protected, payload and the signature of externalAccountBinding. Here they are:
"eyJhbGciOiAiSFMyNTYiLCAia2lkIjogImFwb2xpYWtldml0Y2giLCAidXJsIjogImh0dHBzOi8vcGtpLnRlY2hjb3JwYXBwcy5jb20vYWNtZS9uZXctYWNjb3VudCJ9"
"eyJuIjogInFKYjlRNHF6MUFyOVVUbEk0RTlKM1UwX1pNZW9NLVJaUTYtdEEyZXVVRlcxVFVJWGx2MFRyVVVwSHpraWhiVFRyR0FjUXpQaU5iZk1MQ1FiY1QyMUttdXY5T2xVVUxvclRLTXQ5bXhsNEFncUxtcWxjZEVYaDBKbTdSakZXb0p2Y1NGSm9ZWndnMEhpU1Y5VDBBRF81Ymh0RFlNeGZtbkVqWF9DUW5TYlR2NWtlX0NEQ3FJQzFhemsyRnk1UHVlam5VMzNIY3RnRmdPTlgxanZtVzhGMDBBelpwTm9xRG55Z3JYN1ZDMnRMWEVTNnIyLVJCbjZkbGh2UnNzTGp4U0NyZk9SOGQ2NzUydTQ4LVRLZXk1cS0zQlc5Nm9NV2g4bTZ4M2RfMHd0Tm5wdmwwN0pTUVU3YVg4RUxEbzFZSUtpRzE3OWNSY2l5TWVRNWdkVzQ5VkZtUSIsICJlIjogIkFRQUIiLCAia3R5IjogIlJTQSJ9"
"ZUc21iQ_qFPeppU_B0M-1sPhCw1Fg5ffwKLnCXn5scM"
Then I concatenated protected with '.' and payload.
Then I get the hmac(sha256) hash using the binary form of eab-hmac-key. Finally I encoded the binary hash with base64url. The output does not match the signature.
I have also tried a few other combinations of what I could guess the key is with no luck.
Thanks a lot for the info and help.
The version of my client is (e.g. output of certbot --version
or certbot-auto --version
if you're using Certbot): 1.24.0