I recently started testing Posh-ACME against ssl.com 's new ACME endpoints. The object URIs make it seem like they're running some version of EJBCA under the hood. So this may not be something they can directly fix if it is indeed a bug. In any case, the problem I'm currently running into is that th…

[image] rmbolger: It only includes Digital Signature and Key Encipherment in the standard key usage Key Encipherment is not valid for ECDSA certificates. This is for "when the subject public key is used for enciphering private or secret keys, i.e., for key transport." (RFC 5280). For example…

I'd have to look at it again but I could only get their RSA workflow to work, so that's the only one I included in Certify The Web. It's possible there is a backend issue bubbling up, as 'Missing Authentication Token' is also something AWS API Gateway would say.

I can confirm from the headers implementation is running on AWS, hosted on WildFly (JBoss) and that the RSA account path seems to be working (https://acme.ssl.com/ejbca/acme/sslcom-dv-rsa/acct/<acc id>) Another thing I noticed is that they let your re-use EAB credentials, whereas some others don't. …

Here's the source code for EJBCA: GitHub - primekeydevs/ejbca-ce: EJBCA Community - Open Source Enterprise PKI impressively one of the files is 15 years old, so this has been around a while :slight_smile:

The AWS link is a great find and the response headers do make it seem like it's CloudFront throwing the error before the request even makes it to EJBCA. HTTP/1.1 403 Forbidden Content-Type: application/json Content-Length: 42 Connection: keep-alive Date: Fri, 20 Aug 2021 03:54:03 GMT x-amzn-Request…

Interesting, again maybe you are still using an EC key and that forces it down a non-working path. Certify doesn't put an email address in the CSR either, but the RSA path passes.

[image] rmbolger: But when I try to finalize the order, they throw an error because apparently they're expecting an email address to be included in the CSR. :man_facepalming: { "detail": "Email address cannot be empty or null.. If you need assistance, please contact support@ssl.com", "type"…

Hey @webprofusion , do you recall the error message you got when attempting to get a cert from the EC path? I can get as far as the finalization step where I'm sending the CSR (with a P-256 key) and I get the following error: { "type": "urn:ietf:params:acme:error:badCSR" "detail": "Request…

[image] rmbolger: Requested key usage Just a random thought, but that could be related to the OIDs related to (extended) key usage that are included in the CSR. I mean for signing and whatnot. [image] RFC 5280: Internet X.509 Public Key Infrastructure Certificate and... This memo…

Appreciate the thought, but it's unlikely. It's the same code generating the CSR regardless of the ACME server. It only includes Digital Signature and Key Encipherment in the standard key usage and the normal Client + Server authentication OIDs in the extended key usage. The same values work for the…

try removing clinetauth extkeyuseage? I think some CA don't include that to leaf

Issue with ssl.com's ACME implementation

Client dev

Topic		Replies	Views
Responding to Challenges Client dev	19	1293	March 15, 2024
Domain finalization gets in to an endless loop Help	10	1352	July 15, 2022
ACME Protocol (RFC 8555) and EAB Client dev	19	4901	November 15, 2022
ACME Email S/MIME - All authorizations were not finalized by the CA Help	6	563	October 6, 2025
Api Acme /finalize Client dev	43	2301	April 15, 2024

Issue with ssl.com's ACME implementation

Related topics