# Help creating new account/JWS errors

**URL:** <https://community.letsencrypt.org/t/help-creating-new-account-jws-errors/82456>\
**Category:** Client dev\
**Created:** [January 14, 2019, 8:47am UTC](https://community.letsencrypt.org/t/help-creating-new-account-jws-errors/82456 "2019-01-14T08:47:39Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Spegulo](https://avatars.discourse-cdn.com/v4/letter/s/b5ac83/32.png) [@Spegulo](https://community.letsencrypt.org/u/Spegulo)\
**Post date:** [January 14, 2019, 8:47am UTC](https://community.letsencrypt.org/t/help-creating-new-account-jws-errors/82456/1 "2019-01-14T08:47:39Z")

</div>

Can you show me working example? I try to call [https://acme-staging-v02.api.letsencrypt.org/acme/new-acct](https://acme-staging-v02.api.letsencrypt.org/acme/new-acct) with  
request like this  
{“protected”:“eyJhbGciOiJFUzI1NiIsImp3ayI6eyJjcnYiOiJQLTI1NiIsImt0eSI6IkVDIiwieCI6ImE3VWpEb1lrUi03OG56VzdWcjh6T3BqRHI1SGF2cEtJbW1waGtfM1NvdnciLCJ5IjoiWlZqRnlLSnRvR3lIaWxZdDRtYVBXX1doYWNDdERpSGx2N1JUNTJhdUJnZyJ9LCJ1cmwiOiJodHRwczovL2FjbWUtdjAyLmFwaS5sZXRzZW5jcnlwdC5vcmcvYWNtZS9uZXctYWNjdCIsIm5vbmNlIjoiMldySU1OSjlIUDk4OUxNbnItRkpoNnBNRVE3aXNLODF4UEJLRTZkMy1NZyIsInR5cCI6IkpXUyJ9”,“payload”:“eyJjb250YWN0IjpbIm1haWx0bzpzcGVndWxvQG1haWwucnUiXSwidGVybXNPZlNlcnZpY2VBZ3JlZWQiOnRydWUsInJlc291cmNlIjoibmV3QWNjb3VudCIsImlhdCI6IjE1NDc0NTUwOTkifQ”,“signature”:“MEUCIDa5GvDp5L04IRdeUuXZE4v3gkNLjT0OJtL3WAHMgdP1AiEA0PxjZ2U0ZAOULOcSQLOQGr0mP8828nM6REGuHMvMm2M”}

which signed byDERtoECDSA decoding, but always have  
{  
“type”: “urn:ietf:params:acme:error:malformed”,  
“detail”: “JWS verification error”,  
“status”: 400  
}

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [January 14, 2019, 9:39am UTC](https://community.letsencrypt.org/t/help-creating-new-account-jws-errors/82456/2 "2019-01-14T09:39:47Z")

</div>

Your JWS has a few errors in it (like wrong `url` and a number of useless fields, some of which look like they came from an ACME v1 client).

Perhaps you can either post your code if you need help, or take a look at [acmephp](https://github.com/acmephp/acmephp), which is a "complete" working PHP example for ACME v2.

> [@How to create new account with ECDSA key](https://community.letsencrypt.org/t/how-to-create-new-account-with-ecdsa-key/80437/8):
>
> which signed byDERtoECDSA decoding

You sure? The signature in your JWS is 71 bytes:

```php
$decoded = base64_decode("MEUCIDa5GvDp5L04IRdeUuXZE4v3gkNLjT0OJtL3WAHMgdP1AiEA0PxjZ2U0ZAOULOcSQLOQGr0mP8828nM6REGuHMvMm2M");
echo strlen($decoded), PHP_EOL; // 71

$unpacked = DERtoECDSA($decoded, 64);
echo strlen($unpacked), PHP_EOL; // 64

```

---

<div class="post-metadata">

**Author:** ![Spegulo](https://avatars.discourse-cdn.com/v4/letter/s/b5ac83/32.png) [@Spegulo](https://community.letsencrypt.org/u/Spegulo)\
**Post date:** [January 14, 2019, 9:59am UTC](https://community.letsencrypt.org/t/help-creating-new-account-jws-errors/82456/3 "2019-01-14T09:59:49Z")

</div>

> [@How to create new account with ECDSA key](https://community.letsencrypt.org/t/how-to-create-new-account-with-ecdsa-key/80437/9):
>
> Your JWS has a few errors in it (like wrong `url` and a number of useless fields, some of which look like they came from an ACME v1 client).

Ok, can you say what url is correct and what fields are useless?

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [January 14, 2019, 10:02am UTC](https://community.letsencrypt.org/t/help-creating-new-account-jws-errors/82456/4 "2019-01-14T10:02:12Z")

</div>

I don’t have it in front of me anymore, but I believe:

- The `url` was pointing to the production domain (but you said it’s for `acme-staging-v02`). This would cause the request to fail.
- The `resource` field was present in the protected header, but this doesn’t exist in ACME v2 (it’s from ACME v1). I’m not sure whether this would be a fatal error.
- `iat` in payload (but this is probably not fatal).
- `typ` in protected header (but this is probably not fatal)

---

<div class="post-metadata">

**Author:** ![Spegulo](https://avatars.discourse-cdn.com/v4/letter/s/b5ac83/32.png) [@Spegulo](https://community.letsencrypt.org/u/Spegulo)\
**Post date:** [January 14, 2019, 10:06am UTC](https://community.letsencrypt.org/t/help-creating-new-account-jws-errors/82456/5 "2019-01-14T10:06:20Z")

</div>

> [@How to create new account with ECDSA key](https://community.letsencrypt.org/t/how-to-create-new-account-with-ecdsa-key/80437/11):
>
> The `url` was pointing to the production domain (but you said it’s for `acme-staging-v02` ). This would cause the request to fail.

Staging server uses for debug, on production server I have same problem.  
Regarding the remaining items - I'l try your recomendations, thanks a lot.

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [January 14, 2019, 10:08am UTC](https://community.letsencrypt.org/t/help-creating-new-account-jws-errors/82456/6 "2019-01-14T10:08:16Z")

</div>

Your current “JWS verification error” is caused by the 71-byte signature, but once you get past that, the error message should change - so you’ll know you’re making progress.

---

<div class="post-metadata">

**Author:** ![anon97404107](https://avatars.discourse-cdn.com/v4/letter/a/85f322/32.png) [@anon97404107](https://community.letsencrypt.org/u/anon97404107)\
**Post date:** [January 14, 2019, 4:56pm UTC](https://community.letsencrypt.org/t/help-creating-new-account-jws-errors/82456/7 "2019-01-14T16:56:11Z")

</div>

I released [PHP ACME client](https://github.com/kouk1/php-acme-client/) , it supports P-256 and P-384 ECDSA keys.

I implemented code to subtract unnecessary value  
from ASN.1 objects generated by `openssl_sign` in DER format.

Unnecessary value means ASN.1 object’s TAG field, VALUE LENGTH field, and the others.

Please check the link below for more details of ASN.1.

- [https://tools.ietf.org/html/rfc3279#section-2.2.3](https://tools.ietf.org/html/rfc3279#section-2.2.3)
- [https://tools.ietf.org/html/rfc7515#appendix-A.3](https://tools.ietf.org/html/rfc7515#appendix-A.3)

And the following code may be helpful.

> <https://github.com/kouk1/php-acme-client/blob/master/src/AcmeClient/Infrastructure/Asn1/EcdsaDer.php>

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [February 13, 2019, 4:56pm UTC](https://community.letsencrypt.org/t/help-creating-new-account-jws-errors/82456/8 "2019-02-13T16:56:22Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.